This bug was fixed in the package request-tracker3.8 - 3.8.11-1ubuntu0.1 --------------- request-tracker3.8 (3.8.11-1ubuntu0.1) precise-security; urgency=low
[ Dominic Hargreaves ] * Multiple security fixes for: - XSS vulnerabilities (CVE-2011-2083) - information disclosure vulnerabilities including password hash exposure and correspondence disclosure to privileged users (CVE-2011-2084) - CSRF vulnerabilities allowing information disclosure, privilege escalation, and arbitrary code execution. Original behaviour may be restored by setting $RestrictReferrer to 0 for installations which rely on it (CVE-2011-2085) - remote code execution vulnerabilities including in VERP functionality (CVE-2011-4458) * Fix the vulnerable-passwords script to also upgrade password hashes for disabled users, and rerun the script in postinst (CVE-2011-2082) * Include clean-user-txns script to accompany the above fixes, and run in postinst * Provide specific instructions for restarting a mod_perl based Apache server [ Marc Deslauriers ] * debian/patches/60_misc_sec_regressions.dpatch: fix regression in rt-email-dashboards, and whitelist search results and calendar helper from CSRF protection * SECURITY UPDATE: Multiple security fixes (LP: #1004834): - Email header injection attack (CVE-2012-4730) - CSRF protection allows attack on bookmarks (CVE-2012-4732) - Confused deputy attack for non-logged-in users (CVE-2012-4734) - Multiple message signing/encryption attacks related to GnuPG (CVE-2012-4735) - Arbitrary command-line argument injection to GnuPG (CVE-2012-4884) -- Marc Deslauriers <marc.deslauri...@ubuntu.com> Fri, 09 Nov 2012 15:08:36 -0500 ** Changed in: request-tracker3.8 (Ubuntu Oneiric) Status: Incomplete => Fix Released -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1004834 Title: Multiple security vulnerabilities in request-tracker3.8 To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/request-tracker3.8/+bug/1004834/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs