Description: Two vulnerabilities have been reported in Plone, which can be exploited by malicious people to compromise a vulnerable system.
The vulnerabilities are caused due to errors within the "statusmessages" and "linkintegrity" modules, where unsafe network data is interpreted as python pickles. This can be exploited to execute arbitrary python code within the Zope/Plone process.
The vulnerabilities are reported in Plone 2.5 up to and including version 2.5.4 and Plone 3.0 up to and including version 3.0.2.
If you have new information regarding this Secunia advisory or a product in our database, please send it to us using either our web form or email us at vuln@secunia.com.
Ideas, suggestions, and other feedback are most welcome.
