tags 646754 + patch tags 646754 + pending tags 646769 + patch tags 646769 + pending thanks
Dear maintainer, I've prepared an NMU for phpldapadmin (versioned as 1.2.0.5-2.1) and uploaded it to DELAYED/1. Please feel free to tell me if I should delay it longer. Regards. -- Jonathan Wiltshire j...@debian.org Debian Developer http://people.debian.org/~jmw 4096R: 0xD3524C51 / 0A55 B7C5 1223 3942 86EC 74C3 5394 479D D352 4C51
diff -u phpldapadmin-1.2.0.5/debian/changelog phpldapadmin-1.2.0.5/debian/changelog
--- phpldapadmin-1.2.0.5/debian/changelog
+++ phpldapadmin-1.2.0.5/debian/changelog
@@ -1,3 +1,12 @@
+phpldapadmin (1.2.0.5-2.1) unstable; urgency=high
+
+ * Non-maintainer upload.
+ * CVE-2011-4074 Fix XSS vulnerability in debug code (Closes: #646769)
+ * CVE-2011-4075 Fix arbitrary code execution by unauthenticated users
+ (Closes: #646754)
+
+ -- Jonathan Wiltshire <j...@debian.org> Thu, 27 Oct 2011 17:51:24 +0100
+
phpldapadmin (1.2.0.5-2) unstable; urgency=low
[ Julien Valroff ]
only in patch2:
unchanged:
--- phpldapadmin-1.2.0.5.orig/lib/functions.php
+++ phpldapadmin-1.2.0.5/lib/functions.php
@@ -983,8 +983,9 @@
if (DEBUG_ENABLED && (($fargs=func_get_args())||$fargs='NOARGS'))
debug_log('Entered (%%)',1,0,__FILE__,__LINE__,__METHOD__,$fargs);
- # if the array to sort is null or empty
- if (! $data) return;
+ # if the array to sort is null or empty, or if we have some nasty chars
+ if (! preg_match('/^[a-zA-Z0-9_]+(\([a-zA-Z0-9_,]*\))?$/',$sortby) || ! $data)
+ return;
static $CACHE = array();
only in patch2:
unchanged:
--- phpldapadmin-1.2.0.5.orig/htdocs/cmd.php
+++ phpldapadmin-1.2.0.5/htdocs/cmd.php
@@ -19,10 +19,6 @@
ob_start();
switch ($www['cmd']) {
- case '_debug':
- debug_dump($_REQUEST,1);
- break;
-
default:
if (defined('HOOKSDIR') && file_exists(HOOKSDIR.$www['cmd'].'.php'))
$app['script_cmd'] = HOOKSDIR.$www['cmd'].'.php';
signature.asc
Description: Digital signature
