Your message dated Wed, 05 Jul 2006 13:17:55 -0700
with message-id <[EMAIL PROTECTED]>
and subject line Bug#344674: fixed in phpbb2 2.0.21-1
has caused the attached Bug report to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what I am
talking about this indicates a serious mail system misconfiguration
somewhere. Please contact me immediately.)
Debian bug tracking system administrator
(administrator, Debian Bugs database)
--- Begin Message ---
Package: phpbb2
Severity: important
Tags: security
Please have a look at:
http://marc.theaimsgroup.com/?l=full-disclosure&m=113484567432679&w=2
The mentioned path disclosure is obviously not a problem, but does
the described XSS issue have real-world security implications?
Cheers,
Moritz
-- System Information:
Debian Release: testing/unstable
APT prefers unstable
APT policy: (500, 'unstable')
Architecture: i386 (i686)
Shell: /bin/sh linked to /bin/bash
Kernel: Linux 2.6.14-1-686
Locale: LANG=C, [EMAIL PROTECTED] (charmap=ISO-8859-15)
--- End Message ---
--- Begin Message ---
Source: phpbb2
Source-Version: 2.0.21-1
We believe that the bug you reported is fixed in the latest version of
phpbb2, which is due to be installed in the Debian FTP archive:
phpbb2-conf-mysql_2.0.21-1_all.deb
to pool/main/p/phpbb2/phpbb2-conf-mysql_2.0.21-1_all.deb
phpbb2-languages_2.0.21-1_all.deb
to pool/main/p/phpbb2/phpbb2-languages_2.0.21-1_all.deb
phpbb2_2.0.21-1.diff.gz
to pool/main/p/phpbb2/phpbb2_2.0.21-1.diff.gz
phpbb2_2.0.21-1.dsc
to pool/main/p/phpbb2/phpbb2_2.0.21-1.dsc
phpbb2_2.0.21-1_all.deb
to pool/main/p/phpbb2/phpbb2_2.0.21-1_all.deb
phpbb2_2.0.21.orig.tar.gz
to pool/main/p/phpbb2/phpbb2_2.0.21.orig.tar.gz
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [EMAIL PROTECTED],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Thijs Kinkhorst <[EMAIL PROTECTED]> (supplier of updated phpbb2 package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [EMAIL PROTECTED])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Format: 1.7
Date: Tue, 4 Jul 2006 15:23:28 +0200
Source: phpbb2
Binary: phpbb2-languages phpbb2-conf-mysql phpbb2
Architecture: source all
Version: 2.0.21-1
Distribution: unstable
Urgency: low
Maintainer: Jeroen van Wolffelaar <[EMAIL PROTECTED]>
Changed-By: Thijs Kinkhorst <[EMAIL PROTECTED]>
Description:
phpbb2 - A fully featured and skinnable flat (non-threaded) webforum
phpbb2-conf-mysql - Automatic configurator for phpbb2 on MySQL database
phpbb2-languages - phpBB2 additional languages
Closes: 344674 345359 345359 363676 375865
Changes:
phpbb2 (2.0.21-1) unstable; urgency=low
.
* New upstream release (Closes: #345359, #375865).
+ Addresses obscure security bug: XSS with onmouseover, only exploitable
with Internet Explorer and Allow HTML on which is highly unrecommended
by this package. (CVE-2005-4357, Closes: #344674, #345359)
+ Obsoletes 027_CVE-2006-1896_admin_cmd_exec.diff.
.
* Add 019_disable_logintries.diff: skip this new feature since it's
incompatible with the database-layout.
.
* [JvW] Add to source package disabled patch to enable visual
confirmation for guest posts if visual confirmation is enabled for
registration
http://www.phpbb.com/files/mods/guest_confirmation_1_0_1a.mod
.
* Add 101_fix_german.diff: fixes for German translation, thanks
Mathias Hasselmann (Closes: #363676).
* Add Dutch translation by myself.
.
* Checked for standards version 3.7.2, no changes necessary.
* Update my maintainer address.
Files:
e718f7e150a813e988dea5e69f733a77 717 web optional phpbb2_2.0.21-1.dsc
30383a9bf6c5d21736e4bdf9ec7852d5 3203456 web optional phpbb2_2.0.21.orig.tar.gz
b973e6d14f71a0c0e5895de6440c6ee8 83756 web optional phpbb2_2.0.21-1.diff.gz
bb659e2564cd4ed1d0007afb56ee2c3c 544728 web optional phpbb2_2.0.21-1_all.deb
2eec7b55929330ac2d6f2b0b3c1f14da 51830 web extra
phpbb2-conf-mysql_2.0.21-1_all.deb
1e0fc7ba4891e0bc9e5019fd2d97d72f 2729634 web optional
phpbb2-languages_2.0.21-1_all.deb
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.3 (GNU/Linux)
iD8DBQFErArZJdKMxZV9WM8RAkdJAJ9J9c8HsNUo0N0vDkWKhLlHlbw2fwCfXwjE
JFOORvJrA7XAVhEohh3ACbQ=
=PjcM
-----END PGP SIGNATURE-----
--- End Message ---
