Your message dated Mon, 10 Jan 2011 06:47:09 +0000 with message-id <e1pcbx3-0000dw...@franck.debian.org> and subject line Bug#607693: fixed in mhonarc 2.6.18-1 has caused the Debian Bug report #607693, regarding mhonarc: cross-site scripting when converting HTML mails to be marked as done.
This means that you claim that the problem has been dealt with. If this is not the case it is now your responsibility to reopen the Bug report if necessary, and/or fix the problem forthwith. (NB: If you are a system administrator and have no idea what this message is talking about, this may indicate a serious mail system misconfiguration somewhere. Please contact ow...@bugs.debian.org immediately.) -- 607693: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=607693 Debian Bug Tracking System Contact ow...@bugs.debian.org with problems
--- Begin Message ---Subject: mhonarc: cross-site scripting when converting HTML mails Package: mhonarc Version: 2.6.16-1 Severity: important Tags: security MHonArc has a cross-site scripting (XSS) security issue when converting HTML mails with malformed HTML tags of the form "<scr<body>ipt>": $ mhonarc elsatest.mbox This is MHonArc v2.6.16, Perl 5.010001 linux Converting messages to . Reading elsatest.mbox . Writing mail . Writing ./maillist.html ... Writing ./threads.html ... Writing database ... 1 new messages 1 total messages $ cat msg00000.html <!-- MHonArc v2.6.16 --> <!--X-Subject: mhonarc test --> [..] <!--X-Body-of-Message--> <script>alert("elsa");</script> <!--X-Body-of-Message-End--> [..] -- System Information: Debian Release: squeeze/sid APT prefers testing APT policy: (500, 'testing') Architecture: i386 (i686) Kernel: Linux 2.6.32-5-686 (SMP w/1 CPU core) Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8) Shell: /bin/sh linked to /bin/dash Versions of packages mhonarc depends on: ii perl 5.10.1-16 Larry Wall's Practical Extraction Versions of packages mhonarc recommends: ii perl [libdigest-md5-perl] 5.10.1-16 Larry Wall's Practical Extraction mhonarc suggests no packages. -- no debconf information -- non-customers crew | http://rock-madrid.com/ -- _______________________________________________ Surf the Web in a faster, safer and easier way: Download Opera 9 at http://www.opera.com
elsatest.mbox
Description: Binary data
--- End Message ---
--- Begin Message ---Source: mhonarc Source-Version: 2.6.18-1 We believe that the bug you reported is fixed in the latest version of mhonarc, which is due to be installed in the Debian FTP archive: mhonarc_2.6.18-1.diff.gz to main/m/mhonarc/mhonarc_2.6.18-1.diff.gz mhonarc_2.6.18-1.dsc to main/m/mhonarc/mhonarc_2.6.18-1.dsc mhonarc_2.6.18-1_all.deb to main/m/mhonarc/mhonarc_2.6.18-1_all.deb mhonarc_2.6.18.orig.tar.gz to main/m/mhonarc/mhonarc_2.6.18.orig.tar.gz A summary of the changes between this version and the previous one is attached. Thank you for reporting the bug, which will now be closed. If you have further comments please address them to 607...@bugs.debian.org, and the maintainer will reopen the bug report if appropriate. Debian distribution maintenance software pp. Jeff Breidenbach <j...@debian.org> (supplier of updated mhonarc package) (This message was generated automatically at their request; if you believe that there is a problem with it please contact the archive administrators by mailing ftpmas...@debian.org) -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Format: 1.8 Date: Sun, 09 Jan 2011 17:21:45 -0800 Source: mhonarc Binary: mhonarc Architecture: source all Version: 2.6.18-1 Distribution: unstable Urgency: low Maintainer: Jeff Breidenbach <j...@debian.org> Changed-By: Jeff Breidenbach <j...@debian.org> Description: mhonarc - Mail to HTML converter Closes: 332653 517195 528617 607693 Changes: mhonarc (2.6.18-1) unstable; urgency=low . * New upstream release - Security fix for cross site scriping (closes: bug#607693) - Fix problem with directory creation (closes: #517195) - Fix multibyte character problems (closes: #528617) - Fix memory hog problem (closes: #332653) - Fix multiple denial of service vulnerabilities - Remove minor Debian patches due to upstream incorporation Checksums-Sha1: c92852da8ca5d7bb62c5f39452c4bca166ac05bf 952 mhonarc_2.6.18-1.dsc c5fbb3609c4004563662c20152d5b90317fc52cf 1984873 mhonarc_2.6.18.orig.tar.gz bf5651664d029f3af11c7c2fe82464cc3341f8d5 3837 mhonarc_2.6.18-1.diff.gz 169e81c2bb9f7ae22bbb8cdbe856d195b4e7235b 1928492 mhonarc_2.6.18-1_all.deb Checksums-Sha256: 750ff79f34243b76fe9c753ed2e873c1d4b230c1a52021eb639f1e059a5b9bd2 952 mhonarc_2.6.18-1.dsc 42759d337c13ff87dbc0bc08774df67156405fbfc10e962f640a65ee9a11aef6 1984873 mhonarc_2.6.18.orig.tar.gz 95c38bf796fd0162824d7cef8c7abaec428aa5e793dcd9aff88f7e7dc9b0924f 3837 mhonarc_2.6.18-1.diff.gz c8bae6d861f35650b4446ab3667ca22341f9b33f2e264f389f405b32d65f42b6 1928492 mhonarc_2.6.18-1_all.deb Files: 285f35efad14653e5e2d74e8ab4560d4 952 mail optional mhonarc_2.6.18-1.dsc b65e58fd6d34999493f73efbd8db3c47 1984873 mail optional mhonarc_2.6.18.orig.tar.gz 0369c30214641c0edb4cbab219137a87 3837 mail optional mhonarc_2.6.18-1.diff.gz 69724f434b85ebbf6abb55b425a9eff4 1928492 mail optional mhonarc_2.6.18-1_all.deb -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) iEYEARECAAYFAk0qqQMACgkQazfo3TSzaFZGBgCfbInjRfkH1MyYieEVd304gC1y 3yIAniZ70anSDSfA73C2W95wv2cbJI9S =XDL/ -----END PGP SIGNATURE-----
--- End Message ---
