Ubuntu
request-tracker3.8 package

Branches for Precise

Name		Status	Last Modified	Last Commit
lp:ubuntu/precise/request-tracker3.8		2 Mature	2011-11-10 21:29:11 UTC 2011-11-10	17. * New upstream release * Add Danish d... Author: Dominic Hargreaves Revision Date: 2011-11-10 21:29:11 UTC * New upstream release * Add Danish debconf translation (Closes: #631304)
lp:ubuntu/precise-proposed/request-tracker3.8		2 Mature	2012-11-14 14:44:59 UTC 2012-11-14	18. [ Dominic Hargreaves ] * Multiple sec... Author: Marc Deslauriers Revision Date: 2012-11-09 15:08:36 UTC [ Dominic Hargreaves ] * Multiple security fixes for: - XSS vulnerabilities (CVE-2011-2083) - information disclosure vulnerabilities including password hash exposure and correspondence disclosure to privileged users (CVE-2011-2084) - CSRF vulnerabilities allowing information disclosure, privilege escalation, and arbitrary code execution. Original behaviour may be restored by setting $RestrictReferrer to 0 for installations which rely on it (CVE-2011-2085) - remote code execution vulnerabilities including in VERP functionality (CVE-2011-4458) * Fix the vulnerable-passwords script to also upgrade password hashes for disabled users, and rerun the script in postinst (CVE-2011-2082) * Include clean-user-txns script to accompany the above fixes, and run in postinst * Provide specific instructions for restarting a mod_perl based Apache server [ Marc Deslauriers ] * debian/patches/60_misc_sec_regressions.dpatch: fix regression in rt-email-dashboards, and whitelist search results and calendar helper from CSRF protection * SECURITY UPDATE: Multiple security fixes (LP: #1004834): - Email header injection attack (CVE-2012-4730) - CSRF protection allows attack on bookmarks (CVE-2012-4732) - Confused deputy attack for non-logged-in users (CVE-2012-4734) - Multiple message signing/encryption attacks related to GnuPG (CVE-2012-4735) - Arbitrary command-line argument injection to GnuPG (CVE-2012-4884)
lp:ubuntu/precise-security/request-tracker3.8		2 Mature	2012-11-27 15:15:03 UTC 2012-11-27	18. [ Dominic Hargreaves ] * Multiple sec... Author: Marc Deslauriers Revision Date: 2012-11-09 15:08:36 UTC [ Dominic Hargreaves ] * Multiple security fixes for: - XSS vulnerabilities (CVE-2011-2083) - information disclosure vulnerabilities including password hash exposure and correspondence disclosure to privileged users (CVE-2011-2084) - CSRF vulnerabilities allowing information disclosure, privilege escalation, and arbitrary code execution. Original behaviour may be restored by setting $RestrictReferrer to 0 for installations which rely on it (CVE-2011-2085) - remote code execution vulnerabilities including in VERP functionality (CVE-2011-4458) * Fix the vulnerable-passwords script to also upgrade password hashes for disabled users, and rerun the script in postinst (CVE-2011-2082) * Include clean-user-txns script to accompany the above fixes, and run in postinst * Provide specific instructions for restarting a mod_perl based Apache server [ Marc Deslauriers ] * debian/patches/60_misc_sec_regressions.dpatch: fix regression in rt-email-dashboards, and whitelist search results and calendar helper from CSRF protection * SECURITY UPDATE: Multiple security fixes (LP: #1004834): - Email header injection attack (CVE-2012-4730) - CSRF protection allows attack on bookmarks (CVE-2012-4732) - Confused deputy attack for non-logged-in users (CVE-2012-4734) - Multiple message signing/encryption attacks related to GnuPG (CVE-2012-4735) - Arbitrary command-line argument injection to GnuPG (CVE-2012-4884)
lp:ubuntu/precise-updates/request-tracker3.8		2 Mature	2012-11-27 16:24:14 UTC 2012-11-27	18. [ Dominic Hargreaves ] * Multiple sec... Author: Marc Deslauriers Revision Date: 2012-11-09 15:08:36 UTC [ Dominic Hargreaves ] * Multiple security fixes for: - XSS vulnerabilities (CVE-2011-2083) - information disclosure vulnerabilities including password hash exposure and correspondence disclosure to privileged users (CVE-2011-2084) - CSRF vulnerabilities allowing information disclosure, privilege escalation, and arbitrary code execution. Original behaviour may be restored by setting $RestrictReferrer to 0 for installations which rely on it (CVE-2011-2085) - remote code execution vulnerabilities including in VERP functionality (CVE-2011-4458) * Fix the vulnerable-passwords script to also upgrade password hashes for disabled users, and rerun the script in postinst (CVE-2011-2082) * Include clean-user-txns script to accompany the above fixes, and run in postinst * Provide specific instructions for restarting a mod_perl based Apache server [ Marc Deslauriers ] * debian/patches/60_misc_sec_regressions.dpatch: fix regression in rt-email-dashboards, and whitelist search results and calendar helper from CSRF protection * SECURITY UPDATE: Multiple security fixes (LP: #1004834): - Email header injection attack (CVE-2012-4730) - CSRF protection allows attack on bookmarks (CVE-2012-4732) - Confused deputy attack for non-logged-in users (CVE-2012-4734) - Multiple message signing/encryption attacks related to GnuPG (CVE-2012-4735) - Arbitrary command-line argument injection to GnuPG (CVE-2012-4884)