[ubuntu/oneiric-proposed] request-tracker3.8 3.8.10-1ubuntu0.1 (Accepted)

[Marc Deslauriers]

request-tracker3.8 (3.8.10-1ubuntu0.1) oneiric-security; urgency=low

  * SECURITY UPDATE: Multiple security fixes (LP: #1004834):
    - Email header injection attack (CVE-2012-4730)
    - CSRF protection allows attack on bookmarks (CVE-2012-4732)
    - Confused deputy attack for non-logged-in users (CVE-2012-4734)
    - Multiple message signing/encryption attacks related to GnuPG
      (CVE-2012-4735)
    - Arbitrary command-line argument injection to GnuPG (CVE-2012-4884)
    - XSS vulnerabilities (CVE-2011-2083)
    - information disclosure vulnerabilities including password hash
      exposure and correspondence disclosure to privileged users
      (CVE-2011-2084)
    - CSRF vulnerabilities allowing information disclosure,
      privilege escalation, and arbitrary code execution. Original
      behaviour may be restored by setting $RestrictReferrer to 0 for
      installations which rely on it (CVE-2011-2085)
    - remote code execution vulnerabilities including in VERP
      functionality (CVE-2011-4458)
  * Fix the vulnerable-passwords script to also upgrade password hashes
    for disabled users, and rerun the script in postinst (CVE-2011-2082)
  * Include clean-user-txns script to accompany the above fixes, and
    run in postinst
  * Provide specific instructions for restarting a mod_perl based
    Apache server
  * debian/patches/60_misc_sec_regressions.dpatch: fix regression in
    rt-email-dashboards, and whitelist search results and calendar helper
    from CSRF protection

Date: 2012-11-09 20:55:33.435165+00:00
Changed-By: Marc Deslauriers <marc.deslauriers at canonical.com>
https://launchpad.net/ubuntu/oneiric/+source/request-tracker3.8/3.8.10-1ubuntu0.1
-------------- next part --------------
Sorry, changesfile not available.