Your message dated Mon, 29 Aug 2005 15:47:11 -0700
with message-id <[EMAIL PROTECTED]>
and subject line Bug#323929: fixed in phpgroupware 0.9.16.008-1
has caused the attached Bug report to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what I am
talking about this indicates a serious mail system misconfiguration
somewhere. Please contact me immediately.)
Debian bug tracking system administrator
(administrator, Debian Bugs database)
--------------------------------------
Received: (at submit) by bugs.debian.org; 19 Aug 2005 09:38:31 +0000
>From [EMAIL PROTECTED] Fri Aug 19 02:38:31 2005
Return-path: <[EMAIL PROTECTED]>
Received: from mail-out.m-online.net [212.18.0.9]
by spohr.debian.org with esmtp (Exim 3.36 1 (Debian))
id 1E63KZ-0007Ge-00; Fri, 19 Aug 2005 02:38:31 -0700
Received: from mail.m-online.net (svr20.m-online.net [192.168.3.148])
by mail-out.m-online.net (Postfix) with ESMTP id 7D58EF6A4;
Fri, 19 Aug 2005 11:38:30 +0200 (CEST)
Received: from k.local (ppp-82-135-14-206.mnet-online.de [82.135.14.206])
by mail.m-online.net (Postfix) with ESMTP id 6CF29DBD14;
Fri, 19 Aug 2005 11:38:30 +0200 (CEST)
Received: from stf by k.local with local (Exim 4.52)
id 1E63KY-0001ID-6g; Fri, 19 Aug 2005 11:38:30 +0200
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
From: Stefan Fritsch <[EMAIL PROTECTED]>
To: Debian Bug Tracking System <[EMAIL PROTECTED]>
Subject: phpgroupware-fudforum: Incomplete check of user rights gaining access
to all
messages (CAN-2005-2600)
X-Mailer: reportbug 3.15
Date: Fri, 19 Aug 2005 11:38:30 +0200
Message-Id: <[EMAIL PROTECTED]>
Delivered-To: [EMAIL PROTECTED]
X-Spam-Checker-Version: SpamAssassin 2.60-bugs.debian.org_2005_01_02
(1.212-2003-09-23-exp) on spohr.debian.org
X-Spam-Level:
X-Spam-Status: No, hits=-8.0 required=4.0 tests=BAYES_00,HAS_PACKAGE
autolearn=no version=2.60-bugs.debian.org_2005_01_02
Package: phpgroupware-fudforum
Version: 0.9.16.006-1
Severity: grave
Tags: security
Justification: user security hole
The Fudforum in egroupware is vulnerable to CAN-2005-2600:
FUDForum 2.6.15 with "Tree View" enabled allows remote attackers
to read private posts via a modified mid parameter.
See http://archives.neohapsis.com/archives/fulldisclosure/2005-08/0383.html
---------------------------------------
Received: (at 323929-close) by bugs.debian.org; 29 Aug 2005 22:49:32 +0000
>From [EMAIL PROTECTED] Mon Aug 29 15:49:32 2005
Return-path: <[EMAIL PROTECTED]>
Received: from katie by spohr.debian.org with local (Exim 3.36 1 (Debian))
id 1E9sPH-0007H0-00; Mon, 29 Aug 2005 15:47:11 -0700
From: Thomas Viehmann <[EMAIL PROTECTED]>
To: [EMAIL PROTECTED]
X-Katie: $Revision: 1.56 $
Subject: Bug#323929: fixed in phpgroupware 0.9.16.008-1
Message-Id: <[EMAIL PROTECTED]>
Sender: Archive Administrator <[EMAIL PROTECTED]>
Date: Mon, 29 Aug 2005 15:47:11 -0700
Delivered-To: [EMAIL PROTECTED]
X-Spam-Checker-Version: SpamAssassin 2.60-bugs.debian.org_2005_01_02
(1.212-2003-09-23-exp) on spohr.debian.org
X-Spam-Level:
X-Spam-Status: No, hits=-6.0 required=4.0 tests=BAYES_00,HAS_BUG_NUMBER
autolearn=no version=2.60-bugs.debian.org_2005_01_02
X-CrossAssassin-Score: 4
Source: phpgroupware
Source-Version: 0.9.16.008-1
We believe that the bug you reported is fixed in the latest version of
phpgroupware, which is due to be installed in the Debian FTP archive:
phpgroupware-addressbook_0.9.16.008-1_all.deb
to pool/main/p/phpgroupware/phpgroupware-addressbook_0.9.16.008-1_all.deb
phpgroupware-admin_0.9.16.008-1_all.deb
to pool/main/p/phpgroupware/phpgroupware-admin_0.9.16.008-1_all.deb
phpgroupware-bookmarks_0.9.16.008-1_all.deb
to pool/main/p/phpgroupware/phpgroupware-bookmarks_0.9.16.008-1_all.deb
phpgroupware-calendar_0.9.16.008-1_all.deb
to pool/main/p/phpgroupware/phpgroupware-calendar_0.9.16.008-1_all.deb
phpgroupware-chat_0.9.16.008-1_all.deb
to pool/main/p/phpgroupware/phpgroupware-chat_0.9.16.008-1_all.deb
phpgroupware-comic_0.9.16.008-1_all.deb
to pool/main/p/phpgroupware/phpgroupware-comic_0.9.16.008-1_all.deb
phpgroupware-developer-tools_0.9.16.008-1_all.deb
to pool/main/p/phpgroupware/phpgroupware-developer-tools_0.9.16.008-1_all.deb
phpgroupware-dj_0.9.16.008-1_all.deb
to pool/main/p/phpgroupware/phpgroupware-dj_0.9.16.008-1_all.deb
phpgroupware-eldaptir_0.9.16.008-1_all.deb
to pool/main/p/phpgroupware/phpgroupware-eldaptir_0.9.16.008-1_all.deb
phpgroupware-email_0.9.16.008-1_all.deb
to pool/main/p/phpgroupware/phpgroupware-email_0.9.16.008-1_all.deb
phpgroupware-etemplate_0.9.16.008-1_all.deb
to pool/main/p/phpgroupware/phpgroupware-etemplate_0.9.16.008-1_all.deb
phpgroupware-felamimail_0.9.16.008-1_all.deb
to pool/main/p/phpgroupware/phpgroupware-felamimail_0.9.16.008-1_all.deb
phpgroupware-filemanager_0.9.16.008-1_all.deb
to pool/main/p/phpgroupware/phpgroupware-filemanager_0.9.16.008-1_all.deb
phpgroupware-folders_0.9.16.008-1_all.deb
to pool/main/p/phpgroupware/phpgroupware-folders_0.9.16.008-1_all.deb
phpgroupware-ftp_0.9.16.008-1_all.deb
to pool/main/p/phpgroupware/phpgroupware-ftp_0.9.16.008-1_all.deb
phpgroupware-fudforum_0.9.16.008-1_all.deb
to pool/main/p/phpgroupware/phpgroupware-fudforum_0.9.16.008-1_all.deb
phpgroupware-headlines_0.9.16.008-1_all.deb
to pool/main/p/phpgroupware/phpgroupware-headlines_0.9.16.008-1_all.deb
phpgroupware-hr_0.9.16.008-1_all.deb
to pool/main/p/phpgroupware/phpgroupware-hr_0.9.16.008-1_all.deb
phpgroupware-img_0.9.16.008-1_all.deb
to pool/main/p/phpgroupware/phpgroupware-img_0.9.16.008-1_all.deb
phpgroupware-infolog_0.9.16.008-1_all.deb
to pool/main/p/phpgroupware/phpgroupware-infolog_0.9.16.008-1_all.deb
phpgroupware-manual_0.9.16.008-1_all.deb
to pool/main/p/phpgroupware/phpgroupware-manual_0.9.16.008-1_all.deb
phpgroupware-messenger_0.9.16.008-1_all.deb
to pool/main/p/phpgroupware/phpgroupware-messenger_0.9.16.008-1_all.deb
phpgroupware-news-admin_0.9.16.008-1_all.deb
to pool/main/p/phpgroupware/phpgroupware-news-admin_0.9.16.008-1_all.deb
phpgroupware-nntp_0.9.16.008-1_all.deb
to pool/main/p/phpgroupware/phpgroupware-nntp_0.9.16.008-1_all.deb
phpgroupware-notes_0.9.16.008-1_all.deb
to pool/main/p/phpgroupware/phpgroupware-notes_0.9.16.008-1_all.deb
phpgroupware-phonelog_0.9.16.008-1_all.deb
to pool/main/p/phpgroupware/phpgroupware-phonelog_0.9.16.008-1_all.deb
phpgroupware-phpbrain_0.9.16.008-1_all.deb
to pool/main/p/phpgroupware/phpgroupware-phpbrain_0.9.16.008-1_all.deb
phpgroupware-phpgwapi_0.9.16.008-1_all.deb
to pool/main/p/phpgroupware/phpgroupware-phpgwapi_0.9.16.008-1_all.deb
phpgroupware-phpsysinfo_0.9.16.008-1_all.deb
to pool/main/p/phpgroupware/phpgroupware-phpsysinfo_0.9.16.008-1_all.deb
phpgroupware-polls_0.9.16.008-1_all.deb
to pool/main/p/phpgroupware/phpgroupware-polls_0.9.16.008-1_all.deb
phpgroupware-preferences_0.9.16.008-1_all.deb
to pool/main/p/phpgroupware/phpgroupware-preferences_0.9.16.008-1_all.deb
phpgroupware-projects_0.9.16.008-1_all.deb
to pool/main/p/phpgroupware/phpgroupware-projects_0.9.16.008-1_all.deb
phpgroupware-qmailldap_0.9.16.008-1_all.deb
to pool/main/p/phpgroupware/phpgroupware-qmailldap_0.9.16.008-1_all.deb
phpgroupware-registration_0.9.16.008-1_all.deb
to pool/main/p/phpgroupware/phpgroupware-registration_0.9.16.008-1_all.deb
phpgroupware-setup_0.9.16.008-1_all.deb
to pool/main/p/phpgroupware/phpgroupware-setup_0.9.16.008-1_all.deb
phpgroupware-sitemgr_0.9.16.008-1_all.deb
to pool/main/p/phpgroupware/phpgroupware-sitemgr_0.9.16.008-1_all.deb
phpgroupware-skel_0.9.16.008-1_all.deb
to pool/main/p/phpgroupware/phpgroupware-skel_0.9.16.008-1_all.deb
phpgroupware-soap_0.9.16.008-1_all.deb
to pool/main/p/phpgroupware/phpgroupware-soap_0.9.16.008-1_all.deb
phpgroupware-stocks_0.9.16.008-1_all.deb
to pool/main/p/phpgroupware/phpgroupware-stocks_0.9.16.008-1_all.deb
phpgroupware-todo_0.9.16.008-1_all.deb
to pool/main/p/phpgroupware/phpgroupware-todo_0.9.16.008-1_all.deb
phpgroupware-tts_0.9.16.008-1_all.deb
to pool/main/p/phpgroupware/phpgroupware-tts_0.9.16.008-1_all.deb
phpgroupware-wiki_0.9.16.008-1_all.deb
to pool/main/p/phpgroupware/phpgroupware-wiki_0.9.16.008-1_all.deb
phpgroupware-xmlrpc_0.9.16.008-1_all.deb
to pool/main/p/phpgroupware/phpgroupware-xmlrpc_0.9.16.008-1_all.deb
phpgroupware_0.9.16.008-1.diff.gz
to pool/main/p/phpgroupware/phpgroupware_0.9.16.008-1.diff.gz
phpgroupware_0.9.16.008-1.dsc
to pool/main/p/phpgroupware/phpgroupware_0.9.16.008-1.dsc
phpgroupware_0.9.16.008-1_all.deb
to pool/main/p/phpgroupware/phpgroupware_0.9.16.008-1_all.deb
phpgroupware_0.9.16.008.orig.tar.gz
to pool/main/p/phpgroupware/phpgroupware_0.9.16.008.orig.tar.gz
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [EMAIL PROTECTED],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Thomas Viehmann <[EMAIL PROTECTED]> (supplier of updated phpgroupware package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [EMAIL PROTECTED])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Format: 1.7
Date: Tue, 30 Aug 2005 00:12:58 +0200
Source: phpgroupware
Binary: phpgroupware-stocks phpgroupware-skel phpgroupware-email
phpgroupware-sitemgr phpgroupware-admin phpgroupware-etemplate
phpgroupware-notes phpgroupware-hr phpgroupware-qmailldap
phpgroupware-preferences phpgroupware-fudforum phpgroupware-felamimail
phpgroupware-headlines phpgroupware-infolog phpgroupware-news-admin
phpgroupware-img phpgroupware-developer-tools phpgroupware-nntp
phpgroupware-chat phpgroupware-messenger phpgroupware-projects phpgroupware-ftp
phpgroupware-polls phpgroupware-dj phpgroupware-xmlrpc phpgroupware-bookmarks
phpgroupware-manual phpgroupware-calendar phpgroupware-phpsysinfo
phpgroupware-phpbrain phpgroupware-filemanager phpgroupware-eldaptir
phpgroupware-phonelog phpgroupware-registration phpgroupware-folders
phpgroupware-setup phpgroupware-phpgwapi phpgroupware-comic
phpgroupware-addressbook phpgroupware phpgroupware-todo phpgroupware-tts
phpgroupware-wiki phpgroupware-soap
Architecture: source all
Version: 0.9.16.008-1
Distribution: unstable
Urgency: high
Maintainer: Thomas Viehmann <[EMAIL PROTECTED]>
Changed-By: Thomas Viehmann <[EMAIL PROTECTED]>
Description:
phpgroupware - web based groupware system written in PHP
phpgroupware-addressbook - phpGroupWare addressbook management module
phpgroupware-admin - phpGroupWare administration module
phpgroupware-bookmarks - phpGroupWare bookmark management module
phpgroupware-calendar - phpGroupWare calendar management module
phpgroupware-chat - phpGroupWare chat module
phpgroupware-comic - phpGroupWare comic strip parser module
phpgroupware-developer-tools - phpGroupWare developer tools
phpgroupware-dj - phpGroupWare mp3 database interface module
phpgroupware-eldaptir - phpGroupWare LDAP tree editor module
phpgroupware-email - phpGroupWare E-Mail client module
phpgroupware-etemplate - phpGroupWare etemplate module
phpgroupware-felamimail - phpGroupWare felamimail (Squirrelmail) module
phpgroupware-filemanager - phpGroupWare filemanager module
phpgroupware-folders - phpGroupWare folders module
phpgroupware-ftp - phpGroupWare ftp module
phpgroupware-fudforum - phpGroupWare fudforum module
phpgroupware-headlines - phpGroupWare headlines catcher module
phpgroupware-hr - phpGroupWare human resource management module
phpgroupware-img - phpGroupWare image editor module
phpgroupware-infolog - phpGroupWare infolog applcation
phpgroupware-manual - phpGroupWare on-line manual module
phpgroupware-messenger - phpGroupWare messenger module
phpgroupware-news-admin - phpGroupWare news administration interface
phpgroupware-nntp - phpGroupWare newsgroup reader module
phpgroupware-notes - phpGroupWare notes management module
phpgroupware-phonelog - phpGroupWare phone logging module
phpgroupware-phpbrain - phpGroupWare phpbrain module
phpgroupware-phpgwapi - library of common phpGroupWare functions
phpgroupware-phpsysinfo - phpGroupWare phpSysInfo module
phpgroupware-polls - phpGroupWare polling module
phpgroupware-preferences - phpGroupWare preferences management module
phpgroupware-projects - phpGroupWare projects management module
phpgroupware-qmailldap - phpGroupWare qmailldap module
phpgroupware-registration - phpGroupWare registration module
phpgroupware-setup - phpGroupWare setup III module
phpgroupware-sitemgr - phpGroupWare web content manager
phpgroupware-skel - phpGroupWare skeleton module
phpgroupware-soap - phpGroupWare SOAP module
phpgroupware-stocks - phpGroupWare stock management module
phpgroupware-todo - phpGroupWare todo list management module
phpgroupware-tts - phpGroupWare tts module
phpgroupware-wiki - phpGroupWare wiki module
phpgroupware-xmlrpc - phpGroupWare XMLRPC module
Closes: 318794 322060 323349 323929
Changes:
phpgroupware (0.9.16.008-1) unstable; urgency=high
.
* New upstream release
Security fixes:
- for FUDForum Information Disclosure - see CAN-2005-2600
in phpgroupware-fudforum. Closes: #323929
- Global XSS fix in phpgroupware-phpgwapi (no CAN)
- Security: Disabled XMLRPC (as upstream does) - see CAN-2005-2498
Closes: #323349
* Removed transitional package phpgroupware-core (Closes: #322060)
* Included Czech translation, thank you, Miroslav Kure (Closes: #318794)
Files:
8be9d477239f45253e54d050f6e87d90 1612 web optional
phpgroupware_0.9.16.008-1.dsc
39cfa41e18d5ada449b4297e29e20796 19152020 web optional
phpgroupware_0.9.16.008.orig.tar.gz
de6d52da802e10c15ca229ebe58d403b 35572 web optional
phpgroupware_0.9.16.008-1.diff.gz
39a2fc3510dadb654b800ff09b2cdfa3 160268 web optional
phpgroupware_0.9.16.008-1_all.deb
ee06cf83cb59da32a85c23779f9a8eaf 178902 web optional
phpgroupware-addressbook_0.9.16.008-1_all.deb
44bf7f4ac47b302fff1e167000ba017d 191796 web optional
phpgroupware-admin_0.9.16.008-1_all.deb
7a03d9835a0f509118e7136aafa61b88 102418 web optional
phpgroupware-bookmarks_0.9.16.008-1_all.deb
465f7b06bb9cf4dbb0396829ec1ec50a 334196 web optional
phpgroupware-calendar_0.9.16.008-1_all.deb
dfdd5be8747db2e34fff6b41f98a2294 23452 web optional
phpgroupware-chat_0.9.16.008-1_all.deb
dbc27511b1958c8d3aa6f73f24acf4d5 434714 web optional
phpgroupware-comic_0.9.16.008-1_all.deb
736ccd27a3fedf70f1153e2979c33aba 43950 web optional
phpgroupware-dj_0.9.16.008-1_all.deb
103d746c6e31fcaf8c7a6a3b1167a200 51158 web optional
phpgroupware-eldaptir_0.9.16.008-1_all.deb
fcea3c3dac02a06a22d0fc9d75125fda 1131374 web optional
phpgroupware-email_0.9.16.008-1_all.deb
877d760dedd2510bb61f69aaa2e53aa7 184156 web optional
phpgroupware-felamimail_0.9.16.008-1_all.deb
3dc4560761e16a17aeb46abe377d080f 37004 web optional
phpgroupware-ftp_0.9.16.008-1_all.deb
09ecb98b6cf5a47f1e485e582e683699 64610 web optional
phpgroupware-headlines_0.9.16.008-1_all.deb
e44853a9b4329a3b5f2d1bb7e4f23229 19136 web optional
phpgroupware-hr_0.9.16.008-1_all.deb
e7dd55d9aed0162bb3f9cf33265dace5 8778 web optional
phpgroupware-img_0.9.16.008-1_all.deb
3c23667b1acac4089b745690c487d4f5 140394 web optional
phpgroupware-infolog_0.9.16.008-1_all.deb
00d42c95073561d37cb957450de2a2cf 90852 web optional
phpgroupware-manual_0.9.16.008-1_all.deb
37d340d4ee585130767187d040ce6f50 26584 web optional
phpgroupware-messenger_0.9.16.008-1_all.deb
22982b2795946d52aee68b2e8f1c85e9 47390 web optional
phpgroupware-nntp_0.9.16.008-1_all.deb
b5b7b5c129ca8bd8b7e2b089e55a7a71 35454 web optional
phpgroupware-notes_0.9.16.008-1_all.deb
8a75cd2a45b02737ea9b8061a5db5a2d 20958 web optional
phpgroupware-phonelog_0.9.16.008-1_all.deb
25b6d52553187d32489b08a298c31bee 9413522 web optional
phpgroupware-phpgwapi_0.9.16.008-1_all.deb
2b2fdd08ad5dfd3fa26073af076aa463 116562 web optional
phpgroupware-phpsysinfo_0.9.16.008-1_all.deb
8114d1db18693273d87193863b0bbe8d 32124 web optional
phpgroupware-polls_0.9.16.008-1_all.deb
29dcbe9a67c7d5b460ecab2e14735f48 62848 web optional
phpgroupware-preferences_0.9.16.008-1_all.deb
2da97b5b809b7ab97e6e4c48c2dcb50e 125766 web optional
phpgroupware-projects_0.9.16.008-1_all.deb
ca60cbf5d5c353142e50c7b6a39c07ab 30856 web optional
phpgroupware-registration_0.9.16.008-1_all.deb
6bccf2b13b317b067f05af25a74a4324 278152 web optional
phpgroupware-setup_0.9.16.008-1_all.deb
ef248b01a2534c0b23028316dc3c23cf 19324 web optional
phpgroupware-skel_0.9.16.008-1_all.deb
d78c40bfb6f276f29303e466942a85af 24170 web optional
phpgroupware-soap_0.9.16.008-1_all.deb
6ceeacf1667d99b469a0882ef7a17d35 22272 web optional
phpgroupware-stocks_0.9.16.008-1_all.deb
9a78d1b296fa60e7b75644518e5b6cc0 52016 web optional
phpgroupware-todo_0.9.16.008-1_all.deb
7fd9acd3534fb182a498b2b5b745878f 63638 web optional
phpgroupware-xmlrpc_0.9.16.008-1_all.deb
9937a0db9c2adcad616ab4424569ab34 35368 web optional
phpgroupware-developer-tools_0.9.16.008-1_all.deb
fb7339cc7e829361024c2d144aee6f56 41944 web optional
phpgroupware-news-admin_0.9.16.008-1_all.deb
b4708d66273a083340fc526adb73cdb9 909900 web optional
phpgroupware-sitemgr_0.9.16.008-1_all.deb
8bdb244985a4b8831001957c32693b04 1334008 web optional
phpgroupware-etemplate_0.9.16.008-1_all.deb
98e8d715a57ecdf87f134e6ee7f3c757 94570 web optional
phpgroupware-filemanager_0.9.16.008-1_all.deb
9a8e2db8ae6889a6beea28d879a06f5a 166554 web optional
phpgroupware-folders_0.9.16.008-1_all.deb
84129f3b85e9455c8b7fa831837a9224 1356166 web optional
phpgroupware-fudforum_0.9.16.008-1_all.deb
51072f81d35d89d129f1330f5f91ca43 41630 web optional
phpgroupware-phpbrain_0.9.16.008-1_all.deb
136d300e7d75959ad42db8b7344e9c56 24192 web optional
phpgroupware-qmailldap_0.9.16.008-1_all.deb
d0dbed5b0a1e1758e8925c93a7abf047 57658 web optional
phpgroupware-tts_0.9.16.008-1_all.deb
e2ebeb921e7eccd4e9e45c60bbf5db8b 70584 web optional
phpgroupware-wiki_0.9.16.008-1_all.deb
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (GNU/Linux)
Comment: GnuPG key at <http://thomas.viehmann.net/>
iD8DBQFDE4rrriZpaaIa1PkRAtc9AJ4oz9kr2q/s2TxtgnKKkRuh0GJRwgCfQSS4
jHR7LA0siqP0Q5A9dmOp7AU=
=34A9
-----END PGP SIGNATURE-----
--
To UNSUBSCRIBE, email to [EMAIL PROTECTED]
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
