Bug#1022042: Confirm issue
Hi, I have the same issue, 5.10.0-18 works, 5.10.0-19 crashes the system after disk decryption. AMD Ryzen 7 5700U 00:00.0 Host bridge: Advanced Micro Devices, Inc. [AMD] Renoir Root Complex 00:00.2 IOMMU: Advanced Micro Devices, Inc. [AMD] Renoir IOMMU 00:01.0 Host bridge: Advanced Micro Devices, Inc. [AMD] Renoir PCIe Dummy Host Bridge 00:01.3 PCI bridge: Advanced Micro Devices, Inc. [AMD] Renoir PCIe GPP Bridge 00:02.0 Host bridge: Advanced Micro Devices, Inc. [AMD] Renoir PCIe Dummy Host Bridge 00:02.1 PCI bridge: Advanced Micro Devices, Inc. [AMD] Renoir PCIe GPP Bridge 00:02.2 PCI bridge: Advanced Micro Devices, Inc. [AMD] Renoir PCIe GPP Bridge 00:02.4 PCI bridge: Advanced Micro Devices, Inc. [AMD] Renoir PCIe GPP Bridge 00:08.0 Host bridge: Advanced Micro Devices, Inc. [AMD] Renoir PCIe Dummy Host Bridge 00:08.1 PCI bridge: Advanced Micro Devices, Inc. [AMD] Renoir Internal PCIe GPP Bridge to Bus 00:08.2 PCI bridge: Advanced Micro Devices, Inc. [AMD] Renoir Internal PCIe GPP Bridge to Bus 00:14.0 SMBus: Advanced Micro Devices, Inc. [AMD] FCH SMBus Controller (rev 51) 00:14.3 ISA bridge: Advanced Micro Devices, Inc. [AMD] FCH LPC Bridge (rev 51) 00:18.0 Host bridge: Advanced Micro Devices, Inc. [AMD] Renoir Device 24: Function 0 00:18.1 Host bridge: Advanced Micro Devices, Inc. [AMD] Renoir Device 24: Function 1 00:18.2 Host bridge: Advanced Micro Devices, Inc. [AMD] Renoir Device 24: Function 2 00:18.3 Host bridge: Advanced Micro Devices, Inc. [AMD] Renoir Device 24: Function 3 00:18.4 Host bridge: Advanced Micro Devices, Inc. [AMD] Renoir Device 24: Function 4 00:18.5 Host bridge: Advanced Micro Devices, Inc. [AMD] Renoir Device 24: Function 5 00:18.6 Host bridge: Advanced Micro Devices, Inc. [AMD] Renoir Device 24: Function 6 00:18.7 Host bridge: Advanced Micro Devices, Inc. [AMD] Renoir Device 24: Function 7 01:00.0 Unassigned class [ff00]: Realtek Semiconductor Co., Ltd. RTS522A PCI Express Card Reader (rev 01) 02:00.0 Ethernet controller: Realtek Semiconductor Co., Ltd. RTL8111/8168/8411 PCI Express Gigabit Ethernet Controller (rev 15) 03:00.0 Network controller: Intel Corporation Wi-Fi 6 AX200 (rev 1a) 04:00.0 Non-Volatile memory controller: Samsung Electronics Co Ltd NVMe SSD Controller PM9A1/980PRO 05:00.0 VGA compatible controller: Advanced Micro Devices, Inc. [AMD/ATI] Lucienne (rev c1) 05:00.1 Audio device: Advanced Micro Devices, Inc. [AMD/ATI] Device 1637 05:00.2 Encryption controller: Advanced Micro Devices, Inc. [AMD] Family 17h (Models 10h-1fh) Platform Security Processor 05:00.3 USB controller: Advanced Micro Devices, Inc. [AMD] Renoir USB 3.1 05:00.4 USB controller: Advanced Micro Devices, Inc. [AMD] Renoir USB 3.1 05:00.5 Multimedia controller: Advanced Micro Devices, Inc. [AMD] Raven/Raven2/FireFlight/Renoir Audio Processor (rev 01) 05:00.6 Audio device: Advanced Micro Devices, Inc. [AMD] Family 17h (Models 10h-1fh) HD Audio Controller 06:00.0 SATA controller: Advanced Micro Devices, Inc. [AMD] FCH SATA Controller [AHCI mode] (rev 81) 06:00.1 SATA controller: Advanced Micro Devices, Inc. [AMD] FCH SATA Controller [AHCI mode] (rev 81) Best regards Roland
Bug#915286: TCPDF removal bug 915286
Hi Salvatore, can you provide some more details why TCPDF needs to be removed from buster? TCPDF 6.2.26 entered testing yesterday. I see no more open security issues assigned to this package. This is also the latest version of the application. About #923736 it seems the link is wrong. LDAP Account Manager depends on TCPDF. So its clone bug does not block the TCPDF bug but the other way round. Best regards Roland signature.asc Description: OpenPGP digital signature
Bug#894961: ldap-account-manager: missing dependencies on php-xml and php-zip
forcemerge 871471 894961 stop Hi Thorsten, thanks for your report. This was already addressed in 871471. Best regards Roland signature.asc Description: OpenPGP digital signature
Bug#816041: ldap-account-manager depends on php5-imagick which is no longer built
Hi Peter, On 26.02.2016 22:25, peter green wrote: > ldap-account-manager depends on php5-imagick which is no longer built by > the source package php-imagick. > > I'm not sure if you can just change the dependency to php-imagick or if > more work is needed. thanks, will be fixed in next upload. I updated the dependencies so LAM is compatible with PHP 7. Best regards Roland signature.asc Description: OpenPGP digital signature
Bug#736737: [src:ldap-account-manager] Sourceless file
Hi Bastien, On 26.01.2014 18:11, Bastien ROUCARIES wrote: > You should rebuilt this min.js file from debian/js one ok, I will check how to integrate this in my build process. -- Best regards Roland signature.asc Description: OpenPGP digital signature
Bug#736737: [src:ldap-account-manager] Sourceless file
Hi Bastien, On 26.01.2014 17:40, Bastien ROUCARIES wrote: > No according to ftpmaster you should carry non minified source. Quick > and dirty solution is to add a subdirectory named debian/js with full > source. Does this source are used for debian build ? If so you should > use packaged js file. ok, I will add the sources to debian/js with the next release. They are not used for the Debian build, the orig.tar.bz2 already contains minified JS files. -- Best regards Roland signature.asc Description: OpenPGP digital signature
Bug#736737: [src:ldap-account-manager] Sourceless file
Hi Bastien, On 26.01.2014 15:15, bastien ROUCARIES wrote: > I could not find the source of: > ldap-account-manager 4.4-1 (source) > > templates/lib/100_jquery-1.9.1.min.js > templates/lib/110_jquery-ui-1.10.1.custom.min.js > templates/lib/130_jquery-fineuploader-3.0.min.js > docs/devel/phpdoc/js/jquery-1.4.2.min.js > docs/devel/phpdoc/js/jquery-1.7.1.min.js > docs/devel/phpdoc/js/jquery-ui-1.8.2.custom.min.js > docs/devel/phpdoc/js/jquery.tools.min.js here they are: http://code.jquery.com/jquery-1.9.1.js http://jqueryui.com/resources/download/jquery-ui-1.10.1.zip https://github.com/Widen/fine-uploader/archive/3.0.0.tar.gz http://code.jquery.com/jquery-1.4.2.js http://code.jquery.com/jquery-1.7.1.js http://jqueryui.com/resources/download/jquery-ui-1.8.2.zip https://github.com/jquerytools/jquerytools/archive/v1.2.5.tar.gz In general, all of the min.js files also include the complete source. They just need to be reformatted for better readability. -- Best regards Roland signature.asc Description: OpenPGP digital signature
Bug#726976: ldap-account-manager: Pre-Authentication Cross-Site-Scripting in current_language parameter
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
Hi Eric,
thank you very much for reporting this issue.
There is a patch available now:
https://sourceforge.net/p/lam/bugs/156/#a1dc
Best regards
Roland
On 21.10.2013 08:49, Eric Sesterhenn wrote:
> Package: ldap-account-manager Version: 4.3 Severity: grave Tags:
> security Justification: user security hole
>
> === Security Advisory ===
>
> ldap-account-manager-4.3 - PreAuth XSS
>
>
> Affected Version ldap-account-manager-4.3,
> ldap-account-manager-4.2.1 and possibly others
>
> Problem Overview Technical Risk: medium Likelihood
> of Exploitation: medium Vendor: Debian / Roland Gruber Reported by:
> Eric Sesterhenn Advisory updates:
> http://www.rusty-ice.de/advisory/advisory_2013001.txt Advisory
> Status: Private
>
> Problem Impact == While taking a quick lock at the ldap
> account manager, a XSS issue has been found. It is possible to
> execute JavaScript in a victims' browser after tricking the victim
> to post certain data to the website.
>
>
> Problem Description === The file
> "./templates/login.php" contains an Cross-Site-Scripting Issue on
> line 122. When the parameter current_language is set to malicious
> input (e.g. foo%3A">alert(1)%3Abar) JavaScript is
> executed in the victims' browser. The parameter current_language is
> retrieved from $_SESSION['language'] in line 119, which is a copy
> of $_POST['language'] (line 117).
>
>
> Temporary Workaround and Fix Apply the
> following patch to properly encode the variable:
>
> --- templates/login.php.orig2013-09-25 07:53:03.107208062
> +0200 +++ templates/login.php 2013-09-25 07:53:20.715207533 +0200
> @@ -119,7 +119,7 @@ if (isset($_POST['language'])) {
> $current_language = explode(":",$_SESSION['language']);
> $_SESSION['header'] = " 4.01 Transitional//EN\"
> \"http://www.w3.org/TR/html4/loose.dtd\";>\n\n"; $_SESSION['header']
> .= "\n\n"; -$_SESSION['header'] .= " http-equiv=\"content-type\" content=\"text/html; charset=" .
> $current_language[1] . "\">\n"; +$_SESSION['header'] .= " http-equiv=\"content-type\" content=\"text/html; charset=" .
> htmlentities($current_language[1]) . "\">\n"; $_SESSION['header']
> .= "\n http-equiv=\"cache-control\" content=\"no-cache\">";
>
> /**
>
>
> History === 25.09.2013 - Issue detected 20.10.2013 - Vendor
> notified
>
>
>
> -- System Information: Debian Release: jessie/sid APT prefers
> testing APT policy: (500, 'testing') Architecture: amd64 (x86_64)
> Foreign Architectures: i386
>
> Kernel: Linux 3.10-3-amd64 (SMP w/4 CPU cores) Locale:
> LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8) Shell:
> /bin/sh linked to /bin/dash
>
-BEGIN PGP SIGNATURE-
Version: GnuPG v1.4.12 (GNU/Linux)
Comment: Using GnuPG with Icedove - http://www.enigmail.net/
iEYEARECAAYFAlJlamcACgkQq/ywNCsrGZ58SgCfUFOWSltgfgJrzMO8CsDHRwKS
ougAn3jeIxe3PsswAWNaPQCcFhDjDuPL
=Zxx1
-END PGP SIGNATURE-
--
To UNSUBSCRIBE, email to debian-bugs-rc-requ...@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org
Bug#661904: Multiple vulnerabilities
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
Hi,
I sent a patch for Unstable to my sponsor. This should be uploaded soon.
For Stable the patch is attached. The Stable version is not affected by
the bug in add_value_form.php.
As written before, the report about the problem in list view is invalid
for Stable and Unstable.
- --
Best regards
Roland
-BEGIN PGP SIGNATURE-
Version: GnuPG v1.4.11 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/
iEYEARECAAYFAk9TWJsACgkQq/ywNCsrGZ5kSQCfQejOCdpbHY5k/KoUqh4whHkW
snoAniAbxuSN0GbTLFAuLMROEdJnjFej
=GFlt
-END PGP SIGNATURE-
Description: XSS fix
Use htmlspecialchars to sanitize special characters.
.
ldap-account-manager (3.1.0-3) testing-proposed-updates; urgency=high
.
* Fix "Multiple vulnerabilities"
Replace special characters in HTML output. (Closes: #661904)
Author: Roland Gruber
Bug-Debian: http://bugs.debian.org/661904
---
The information above should follow the Patch Tagging Guidelines, please
checkout http://dep.debian.net/deps/dep3/ to learn about the format. Here
are templates for supplementary fields that you might want to add:
Origin: ,
Bug:
Bug-Debian: http://bugs.debian.org/
Bug-Ubuntu: https://launchpad.net/bugs/
Forwarded:
Reviewed-By:
Last-Update:
--- ldap-account-manager-3.1.0.orig/templates/tree/export.php
+++ ldap-account-manager-3.1.0/templates/tree/export.php
@@ -119,15 +119,21 @@ $exporter->setOutputFormat($br);
@set_time_limit( 0 );
// send the header
-if( $save_as_file )
- header( "Content-type: application/download" );
-else
- header( "Content-type: text/plain" );
header( "Content-Disposition:
filename=$friendly_rdn.".$exporters[$exporter_id]['extension'] );
header( "Expires: Mon, 26 Jul 1997 05:00:00 GMT" );
header( "Last-Modified: " . gmdate("D, d M Y H:i:s") . " GMT" );
header( "Cache-Control: post-check=0, pre-check=0", false );
+if( $save_as_file ) {
+ header( "Content-type: application/download" );
+ $exporter->export();
+}
+else {
+ header( "Content-type: text/plain" );
+ ob_start();
+ $exporter->export();
+ $buffer = ob_get_contents();
+ ob_end_clean();
+ echo htmlspecialchars($buffer);
+}
-// and export
-$exporter->export();
?>
XSS.sig
Description: PGP signature
Bug#661904: Multiple vulnerabilities
clone 661904 -1 reassign -1 phpldapadmin stop This problem is located in the phpLDAPadmin part of LAM's code. Therefore, the phpldapadmin package is also affected. Patches for LAM upstream that may be ported to PLA: http://lam.cvs.sourceforge.net/viewvc/lam/lam/templates/3rdParty/pla/lib/export_functions.php?r1=1.4&r2=1.5 http://lam.cvs.sourceforge.net/viewvc/lam/lam/templates/3rdParty/pla/htdocs/export.php?r1=1.1&r2=1.2 http://lam.cvs.sourceforge.net/viewvc/lam/lam/templates/3rdParty/pla/htdocs/add_value_form.php?r1=1.6&r2=1.7 Bug report with better description: http://secunia.com/advisories/48221/ Best regards Roland -- To UNSUBSCRIBE, email to debian-bugs-rc-requ...@lists.debian.org with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org
Bug#661904: Multiple vulnerabilities
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Hi, the first problem in user listing cannot be reproduced: * The filter value which should contain malicious code is correctly sanitized with htmlspecialchars() in LAM 3.6 and 3.1.0-2 (stable). * list.php-filter-Dateien/error.png is not a script that is included in LAM The other points are under investigation. I will work on a patch. Best regards Roland Am 02.03.2012 14:16, schrieb Moritz Muehlenhoff: > Package: ldap-account-manager > Severity: grave > Tags: security > > The following was reported to full-disclosure: > http://www.vulnerability-lab.com/get_content.php?id=458 > > Cheers, > Moritz > > > - -- Mit freundlichen Grüßen Roland Gruber -BEGIN PGP SIGNATURE- Version: GnuPG v1.4.11 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ iEYEARECAAYFAk9RNyQACgkQq/ywNCsrGZ6k8QCeP9+Ii9eD0kj/5hJHVRUN/Zom R2MAn2d38e0C8fAsJkinZRBE9RzILJ2W =DPNE -END PGP SIGNATURE- -- To UNSUBSCRIBE, email to debian-bugs-rc-requ...@lists.debian.org with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org
Bug#606794: ldap-account-manager: package fails to upgrade properly from lenny
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Hi Lucas, Am 11.12.2010 18:11, schrieb Lucas Nussbaum: > While testing the installation of all packages in squeeze, I ran > into the following problem: [...] >> Setting up ldap-account-manager (3.1.0-2) ... >> >> Configuration file `/etc/ldap-account-manager/config.cfg' >> ==> Modified (by you or by a script) since installation. >> ==> Package distributor has shipped an updated version. >> What would you like to do about it ? Your options are: >> Y or I : install the package maintainer's version >> N or O : keep your currently-installed version >> D : show the differences between the versions >> Z : start a shell to examine the situation >> The default action is to keep your current version. >> *** config.cfg (Y/I/N/O/D/Z) [default=N] ? dpkg: error processing >> ldap-account-manager (--configure): >> EOF on stdin at conffile prompt >> Errors were encountered while processing: >> ldap-account-manager >> E: Sub-process /usr/bin/dpkg returned an error code (1) > > Note that the configuration files were not modified during the test, > so this should not happen. this is a bug (#582020) in the lenny version of ldap-account-manager. It was fixed in 3.0.0-2. The bug affects all package upgrades. How should we proceed with this bug, merge it with #582020 or tag it lenny? - -- Best regards Roland -BEGIN PGP SIGNATURE- Version: GnuPG v1.4.10 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ iEYEARECAAYFAk0Eoi0ACgkQq/ywNCsrGZ4QFgCfSXE3tzHO9sudnmpk2lj4FK6X NgUAnRFY7eR8zBbcLCFVfnNeg/xqcN4q =kICT -END PGP SIGNATURE- -- To UNSUBSCRIBE, email to debian-bugs-rc-requ...@lists.debian.org with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org
Bug#416886: depends on non-essential package debconf in postrm
Hi, thanks for the hint. This will be fixed in the next package version. -- Best regards Roland Gruber LDAP Account Manager http://lam.sourceforge.net Want more? Get LDAP Account Manager Pro! http://lam.sourceforge.net/lamPro/index.htm signature.asc Description: OpenPGP digital signature
Bug#415379: fixed in testing but what about unstable
Hi Peter, peter green schrieb: > this bug has been fixed in testing through a TPU upload but there doesn't > seem to be any information on if it is still present in unstable. yes, it is still present in Unstable. But since the regular 1.3.0 release which includes a fix will be published tomorrow, I did not build a patch. I also built a patch for Stable but my sponsor did not yet upload it. -- Best regards Roland Gruber LDAP Account Manager http://lam.sourceforge.net Want more? Get LDAP Account Manager Pro! http://lam.sourceforge.net/lamPro/index.htm signature.asc Description: OpenPGP digital signature
Bug#391331: ldap-account-manager: etch version broken
Hi Brian, Brian May schrieb: >> Warning: Wrong parameter count for class_exists() in >> /usr/share/php/fpdf/fpdf.php on line 12 >> > > > I replaced this condition with "if (true)" and not all I get is a blank > page. Hmmm this is a bug in the package php-fpdf. Please try installing php-fpdf 1.53.dfsg-4.1. Greetings Roland -- LDAP Account Manager http://lam.sourceforge.net Want more? Get LDAP Account Manager Pro! http://lam.sourceforge.net/lamPro/index.htm signature.asc Description: OpenPGP digital signature
Bug#388711: PHP API
Hi Lucas, you are right, there is a second argument. But not on the German manual page. ;-) Looks like the second parameter was introduced recently (maybe in PHP5). Is there any reason why the class_exists-call cannot be removed? Peter, can you discuss this with upstream? Greetings Roland -- LDAP Account Manager http://lam.sourceforge.net Want more? Get LDAP Account Manager Pro! http://lam.sourceforge.net/lamPro/index.htm signature.asc Description: OpenPGP digital signature
Bug#388711: Bug 388711
Hi, I think this is a bug in the FPDF package. I noticed that you added a second parameter "false" to the class_exists() call. The PHP API documentation does not include such a second parameter. I suggest to remove the class_exists() call completely. Libraries are included with include_once() and there is no need for such a check. Greetings Roland -- LDAP Account Manager http://lam.sourceforge.net Want more? Get LDAP Account Manager Pro! http://lam.sourceforge.net/lamPro/index.htm signature.asc Description: OpenPGP digital signature
Bug#380658: [Pkg-openldap-devel] Bug#380658: slapd: Package upgrade hangs
Hi Steve, Steve Langasek schrieb: >>When upgrading from 2.3.24-1 to 2.3.24-2 the package installation hangs. >>I have to press Ctrl+C. Apt-get asked me to install a new version of >>slapd.conf which I did not. Maybe this is related to this behaviour. > > > Are you running nss_ldap on this system? If so, please see bug #379728. yes, disabling nss_ldap resolved the problem. Thanks for the hint. Greetings Roland signature.asc Description: OpenPGP digital signature
Bug#380658: slapd: Package upgrade hangs
Package: slapd Version: 2.3.24-2 Severity: grave Justification: renders package unusable When upgrading from 2.3.24-1 to 2.3.24-2 the package installation hangs. I have to press Ctrl+C. Apt-get asked me to install a new version of slapd.conf which I did not. Maybe this is related to this behaviour. -- System Information: Debian Release: testing/unstable APT prefers testing APT policy: (500, 'testing'), (500, 'stable') Architecture: i386 (i686) Shell: /bin/sh linked to /bin/bash Kernel: Linux 2.6.17.1 Locale: [EMAIL PROTECTED], [EMAIL PROTECTED] (charmap=ISO-8859-15) (ignored: LC_ALL set to [EMAIL PROTECTED]) Versions of packages slapd depends on: ii adduser 3.95 Add and remove users and groups ii coreutils 5.96-5 The GNU core utilities ii debconf [debconf-2.0] 1.5.2Debian configuration management sy ii libc6 2.3.6-15 GNU C Library: Shared libraries ii libdb4.24.2.52-23.1 Berkeley v4.2 Database Libraries [ ii libiodbc2 3.52.4-3 iODBC Driver Manager ii libldap-2.3-0 2.3.24-2 OpenLDAP libraries ii libltdl31.5.22-4 A system independent dlopen wrappe ii libperl5.8 5.8.8-4 Shared Perl library ii libsasl22.1.19.dfsg1-0.2 Authentication abstraction library ii libslp1 1.2.1-5 OpenSLP libraries ii libssl0.9.8 0.9.8b-2 SSL shared libraries ii libwrap07.6.dbs-9Wietse Venema's TCP wrappers libra ii perl [libmime-base64-pe 5.8.8-4 Larry Wall's Practical Extraction ii psmisc 22.2-1 Utilities that use the proc filesy Versions of packages slapd recommends: ii db4.2-util 4.2.52-23.1 Berkeley v4.2 Database Utilities ii libsasl2-modules2.1.19.dfsg1-0.2 Pluggable Authentication Modules f -- debconf information: slapd/fix_directory: true * shared/organization: test slapd/upgrade_slapcat_failure: slapd/backend: BDB * slapd/allow_ldap_v2: true slapd/no_configuration: false slapd/move_old_database: true slapd/suffix_change: false slapd/invalid_suffix: false slapd/slave_databases_require_updateref: * slapd/dump_database_destdir: /var/backups/slapd-VERSION slapd/autoconf_modules: true * slapd/domain: o=test.c=de slapd/password_mismatch: slapd/invalid_config: true slapd/upgrade_slapadd_failure: * slapd/dump_database: when needed slapd/migrate_ldbm_to_bdb: false slapd/purge_database: false slapd/admin: -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
Bug#368804: Bug#375453: bugs 368804 and 375453 present in 0.4.9-2 in sarge?
Hi Stefan, Stefan Fritsch schrieb: > Just for the record, has anyone of you checked whether these bugs are > present in sarge? no, the invalid password option was introduced with LAM 0.5. Sarge has 0.4.9. Greetings Roland -- LDAP Account Manager http://lam.sourceforge.net signature.asc Description: OpenPGP digital signature
Bug#375453: Invalid/Lock password auto reverts
Hi Brian,
Brian May schrieb:
> If I save the users settings *without* going to the "Unix" settings page
> no errors are produced, but the users password is changed:
>
> "{crypt}*" --> "{crypt}"
> "{crypt}!" --> "{crypt}"
> "{crypt}!password" --> "{crypt}password"
>
> As far as I can tell there are no security ramifications for the first
> two situations, as the password is still invalid, but it very weird.
> Unfortunately, it appears the last case will automatically unlock a
> locked account even though I never told ldap-account-manager to do so.
thanks for your report, this will be fixed asap.
Greetings,
Roland
--
LDAP Account Manager
http://lam.sourceforge.net
signature.asc
Description: OpenPGP digital signature
Bug#368804: Invalid/Lock password options don't work
Hi Stephan, Brian May schrieb: > If I use the "Invalid Password" option in the "Unix" section of a user, > I get a password of *. This is not invalid. pam_ldap accepts the > password fine and allows the user to log in. Perhaps that means the > fault is with pam_ldap, not sure. can you tell me why pam-ldap accepts a "*" as password? Should LDAP accounts not be formated just like accounts in /etc/(passwd|shadow)? How do I disable an account, setting no userPassword attribute at all? When I set a user password which starts with "*" then "getent shadow" shows me an "x" in the password field. Greetings Roland -- LDAP Account Manager http://lam.sourceforge.net signature.asc Description: OpenPGP digital signature
Bug#354444: tetex-base: Again md5sum not known.
Package: tetex-base Version: 2.0.2c-9 Severity: grave Justification: renders package unusable I get this error when upgrading to tetex-base 3.0-14: /etc/texmf/map/dvips/context/original-adobe-euro.map: md5sum not known. Exiting The package cannot be installed. -- System Information: Debian Release: testing/unstable APT prefers testing APT policy: (500, 'testing') Architecture: i386 (i686) Shell: /bin/sh linked to /bin/bash Kernel: Linux 2.6.15.4 Locale: [EMAIL PROTECTED], [EMAIL PROTECTED] (charmap=ISO-8859-15) (ignored: LC_ALL set to [EMAIL PROTECTED]) Versions of packages tetex-base depends on: ii debconf [debconf-2.0] 1.4.70 Debian configuration management sy ii dpkg 1.13.13package maintenance system for Deb ii ucf 2.005 Update Configuration File: preserv Versions of packages tetex-base recommends: pn tetex-doc (no description available) -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
Bug#305989: kpresenter: crashes when creating new screen presentation
Package: kpresenter Version: 1:1.3.5-3 Severity: grave Justification: renders package unusable KPresenter crashes when I want to create a new presentation with format "Screen". There is no difference between choosing the templates (Empty, Title, ...). The application exits without a message (also no messages on command line). I already tried starting kpresenter with a new user account with the same result. If I create an A4 or letter presentation there seems to be no problems. According to strace the last thing which kpresenter does is reading the kdeglobals file. I can send you a complete trace if needed. -- System Information: Debian Release: 3.1 APT prefers testing APT policy: (500, 'testing') Architecture: i386 (i686) Kernel: Linux 2.4.25 Locale: [EMAIL PROTECTED], [EMAIL PROTECTED] (charmap=ISO-8859-15) (ignored: LC_ALL set to [EMAIL PROTECTED]) Versions of packages kpresenter depends on: ii kdelibs4 4:3.3.2-4.0.2 KDE core libraries ii koffice-libs 1:1.3.5-3 common libraries and binaries for ii libart-2.0-2 2.3.17-1Library of functions for 2D graphi ii libarts1 1.3.2-3 aRts Sound system ii libasound2 1.0.8-3 ALSA library ii libaspell15 0.60.2+20050121-2 The GNU Aspell spell-checker runti ii libaudio21.7-2 The Network Audio System (NAS). (s ii libaudiofile00.2.6-6 Open-source version of SGI's audio ii libc62.3.2.ds1-20GNU C Library: Shared libraries an ii libesd0 0.2.35-2Enlightened Sound Daemon - Shared ii libfam0c102 2.7.0-6 client library to control the FAM ii libgcc1 1:3.4.3-12 GCC support library ii libglib2.0-0 2.6.4-1 The GLib library of C routines ii libice6 4.3.0.dfsg.1-12.0.1 Inter-Client Exchange library ii libidn11 0.5.13-1.0 GNU libidn library, implementation ii libjack0.80.0-0 0.99.0-6JACK Audio Connection Kit (librari ii libmad0 0.15.1b-1.1 MPEG audio decoder library ii libogg0 1.1.2-1 Ogg Bitstream Library ii libpng12-0 1.2.8rel-1 PNG library - runtime ii libqt3c102-mt3:3.3.4-2 Qt GUI Library (Threaded runtime v ii libsm6 4.3.0.dfsg.1-12.0.1 X Window System Session Management ii libstdc++5 1:3.3.5-8 The GNU Standard C++ Library v3 ii libvorbis0a 1.1.0-1 The Vorbis General Audio Compressi ii libvorbisenc21.1.0-1 The Vorbis General Audio Compressi ii libvorbisfile3 1.1.0-1 The Vorbis General Audio Compressi ii libx11-6 4.3.0.dfsg.1-12.0.1 X Window System protocol client li ii libxext6 4.3.0.dfsg.1-12.0.1 X Window System miscellaneous exte ii libxrender1 0.8.3-7 X Rendering Extension client libra ii libxt6 4.3.0.dfsg.1-12.0.1 X Toolkit Intrinsics ii perl 5.8.4-8 Larry Wall's Practical Extraction ii xlibs4.3.0.dfsg.1-12 X Keyboard Extension (XKB) configu ii zlib1g 1:1.2.2-3 compression library - runtime -- no debconf information -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
