What is Escalations Supplement erg712807, the Security fix for htdig?


Problem Fixed
-------------

   htdig suffers from a cross site scripting flaw.


Contents
--------

  /usr/bin/htsearch


Software Notes and Recommendations
----------------------------------

  erg712807 should only be installed on:

  UnixWare 7.1.4 Maintenance Pack 2


Warning
-------

  This package is produced by the SCO Escalations Research Group and is
  not intended for general distribution.  It has been produced to
  address a particular problem and has not been tested in all system
  configurations.


Installation Instructions
-------------------------

  1. Download the erg712807.Z file to the /tmp directory on your machine.

  2. As root, add the package to your system using these commands:

     $ su -
     Password: <type your root password>
     # zcat /tmp/erg712807.Z | pkgadd -d -

     Alternatively, this package may be installed in quiet mode, that is,
     without displaying the release notes and asking for confirmation.
     To do this, use these commands:

     $ su -
     Password: <type your root password>
     # zcat /tmp/erg712807.Z | pkgadd -qd - all

  3. There is no need to reboot the system after installing this package.
     However, if your system is running any libraries or commands that are
     contained in this package, then these programs will continue to run
     with the old versions of these libraries or commands until the system
     is rebooted.

     Note that when all necessary patches have been installed, it is good
     practice to reboot the system at the earliest opportunity.  This will
     ensure that no programs continue to run with the old libraries or
     commands.


Removal Instructions
--------------------

  1. As root, remove the package using these commands:

     $ su -
     Password: <type your root password>
     # pkgrm erg712807

  2. Reboot the system after removing this package.

  If you have questions regarding this supplement, or the product on
  which it is installed, please contact your software supplier.