Two security issues and a vulnerability have been reported in Django, which can be exploited by malicious people to conduct cross-site scripting attacks and cause a DoS (Denial of Service).

1) Input passed to the redirection functionality of the login() or logout() views within the authentication framework is not properly sanitised before being returned to the user after redirection to a "data:" scheme URL. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

2) An error within the validation of images in the ImageField class when handling the decompression of images can be exploited to consume memory resources.

3) An error within the calculation of image dimensions in the ImageFile class can be exploited to consume server resources and potentially cause the application to stop responding.

The security issues and the vulnerability are reported in versions 1.3 and 1.4. Other versions may also be affected.

Solution
Apply patches or update to versions 1.3.2 or 1.4.1.

Provided and/or discovered by
The vendor credits:
1) An anonymous person
2) A user within a bug report
3) Jeroen Dekkers

Original Advisory
https://www.djangoproject.com/weblog/2012/jul/30/security-releases-issued/

Deep Links
Links available to Secunia VIM customers