Bug#386519: [Pkg-sql-ledger-discussion] Re: Bug#386519: sql-ledger: Security vulnerability CVE-2006-4244

2006-09-12 Thread Raphael Hertzog
On Tue, 12 Sep 2006, Finn-Arne Johansen wrote: > > Indeed, but I just generated a new version of that update since a second > > security issue has been fixed in 2.6.19 (a directory traversal bug). I > > also applied applied the fix for the "new window" function which broke due > > to the change in

Bug#386519: [Pkg-sql-ledger-discussion] Re: Bug#386519: sql-ledger: Security vulnerability CVE-2006-4244

2006-09-12 Thread Finn-Arne Johansen
Raphael Hertzog skrev: > On Tue, 12 Sep 2006, Finn-Arne Johansen wrote: >> Dieter Simader skrev: >>> The sessionid is still there but not used anymore. >>> >>> If you need more info let me know. >> OK, as said - I've tested that the new package installs ok, but I have >> not found the time to check

Bug#386519: Re: Bug#386519: [Pkg-sql-ledger-discussion] Re: Bug#386519: sql-ledger: Security vulnerability CVE-2006-4244

2006-09-12 Thread Raphael Hertzog
On Tue, 12 Sep 2006, Finn-Arne Johansen wrote: > Dieter Simader skrev: > > The sessionid is still there but not used anymore. > > > > If you need more info let me know. > > OK, as said - I've tested that the new package installs ok, but I have > not found the time to check how the bug is fixed. >

Bug#386519: [Pkg-sql-ledger-discussion] Re: Bug#386519: sql-ledger: Security vulnerability CVE-2006-4244

2006-09-12 Thread Finn-Arne Johansen
Dieter Simader skrev: > The sessionid is still there but not used anymore. > > If you need more info let me know. OK, as said - I've tested that the new package installs ok, but I have not found the time to check how the bug is fixed. Since I'm under a rather heavy workload now, I doubt that I c

Bug#386519: [Pkg-sql-ledger-discussion] Re: Bug#386519: sql-ledger: Security vulnerability CVE-2006-4244

2006-09-11 Thread Finn-Arne Johansen
Raphael Hertzog skrev: > On Fri, 08 Sep 2006, Chris Morris wrote: >> Package: sql-ledger >> Severity: grave >> Tags: security >> Justification: user security hole >> >> http://cve.mitre.org/cgi-bin/cvename.cgi?name=2006-4244 >> Recently fully disclosed at >> http://www.securityfocus.com/archive/1/4