Bug#504172: CVE-2008-4796: missing input sanitising in Snoopy.class.php

2008-11-01 Thread Steffen Joeris
Package: mediamate Severity: grave Tags: security, patch Justification: user security hole Hi, the following CVE (Common Vulnerabilities Exposures) id was published for mediamate. CVE-2008-4796[0]: | The _httpsrequest function (Snoopy/Snoopy.class.php) in Snoopy 1.2.3 | and earlier allows

Bug#504172: CVE-2008-4796: missing input sanitising in Snoopy.class.php

2008-11-01 Thread Jamin W. Collins
Steffen Joeris wrote: the following CVE (Common Vulnerabilities Exposures) id was published for mediamate. CVE-2008-4796[0]: | The _httpsrequest function (Snoopy/Snoopy.class.php) in Snoopy 1.2.3 | and earlier allows remote attackers to execute arbitrary commands via | shell metacharacters in

Bug#504172: CVE-2008-4796: missing input sanitising in Snoopy.class.php

2008-11-01 Thread Jamin W. Collins
Jamin W. Collins wrote: Steffen Joeris wrote: The extracted patch for Snoopy.class.php can be found here[1]. However it would be much appreciated (and it is a release goal anyway), if you could just depend on libphp-snoopy, instead of duplicating the code. (Maybe you need to change some