Bug#504171: CVE-2008-4796: missing input sanitising

2008-11-03 Thread Evgeni Golov
Hi, attached you find a NMU I've prepared for pixelpost to fix the Security issue. It basically stops shipping the Snoopy class but depends on libphp-snoopy. Xavier, any objections that I'll upload it? Or do you want to handle this on your own. Regards Evgeni diff -u

Bug#504171: CVE-2008-4796: missing input sanitising

2008-11-03 Thread Xavier Luthi
On Mon, Nov 03, 2008 at 10:27:26AM +0100, Evgeni Golov wrote: Hi, attached you find a NMU I've prepared for pixelpost to fix the Security issue. It basically stops shipping the Snoopy class but depends on libphp-snoopy. Xavier, any objections that I'll upload it? Or do you want to handle

Bug#504171: CVE-2008-4796: missing input sanitising

2008-11-01 Thread Steffen Joeris
Package: pixelpost Severity: grave Tags: security, patch Justification: user security hole Hi, the following CVE (Common Vulnerabilities Exposures) id was published for pixelpost. CVE-2008-4796[0]: | The _httpsrequest function (Snoopy/Snoopy.class.php) in Snoopy 1.2.3 | and earlier allows