awstats 6.3-1 source package in Ubuntu

Changelog

awstats (6.3-1) unstable; urgency=high


  * New upstream release. Closes: bug#293702, #293668 (thanks to Nelson
    A. de Oliveira <email address hidden>).
    + Includes upstream fix for security bug fixed in 6.2-1.1.
    + Includes upstream fix for most of security bug fixed in 6.2-1.1.
  * Acknowledge NMUs. Closes: bug#291064, #294488 (thanks to Martin
    Schulze <email address hidden>, Martin Pitt <email address hidden>, Ubuntu,
    Joey Hess <email address hidden>, Frank Lichtenheld <email address hidden> and Steve
    Langasek <email address hidden>).
  * Include patch for last parts of security bug fixed in 6.2-1.1:
    01_sanitize_more.patch.
  * Patch (02) to include snapshot of recent development:
    + Fix security hole that allowed a user to read log file content
      even when plugin rawlog was not enabled.
    + Fix a possible use of AWStats for a DoS attack.
    + configdir option was broken on windows servers.
    + DebugMessages is by default set to 0 for security reasons.
    + Minor fixes.
  * References:
    CAN-2005-0435 - read server logs via loadplugin and pluginmode
    CAN-2005-0436 - code injection via PluginMode
    CAN-2005-0437 - directory traversal via loadplugin
    CAN-2005-0438 - information leak via debug

 -- Jonas Smedegaard <email address hidden>  Sat,  5 Feb 2005 17:13:48 +0100