[roundup] [CVE-2008-1474] cross-site scripting vulnerability

[disabled.user]

Binary package hint: roundup

References:
DSA-1554-1 (http://www.debian.org/security/2008/dsa-1554)

QuotingDSA-1554-1:
"Roundup, an issue tracking system, fails to properly escape HTML input,
allowing an attacker to inject client-side code (typically JavaScript)
into a document that may be viewed in the victim's browser."

Quoting CVE-2008-1474:
"Multiple unspecified vulnerabilities in Roundup before 1.4.4 have unknown impact and attack vectors, some of which may be related to cross-site scripting (XSS)."

[Ralph Corderoy (ralph-inputplus)]

Does this mean 8.04's roundup is susceptible as things stand? I see all those "nominated" for release after release. I was planning on installing it, but now I'm not sure.

[William Grant (wgrant)]

Actually, my last merge fixed this in Hardy months ago. It's safe.

[Hew (hew)]

Ubuntu Feisty Fawn is no longer supported, so a SRU will not be issued for this release. Marking Feisty as Won't Fix.

[Sergio Zanchetta (primes2h)]

The 18 month support period for Gutsy Gibbon 7.10 has reached its end of life -
http://www.ubuntu.com/news/ubuntu-7.10-eol . As a result, we are closing the
Gutsy task.

[Jamie Strandboge (jdstrand)]

Thank you for reporting this bug to Ubuntu. dapper has reached EOL
(End of Life) and is no longer supported. As a result, this bug
against dapper is being marked "Won't Fix". Please see
https://wiki.ubuntu.com/Releases for currently supported Ubuntu
releases.

Please feel free to report any other bugs you may find.