Cross-site scripting vulnerability in namazu2 - old lucid version

[Xela]

Lucid still has namazu2 version 2.0.20 which is vulnerable to cross-site scripting.
More info here: http://www.namazu.org/security.html#cross-site-scripting

Is there any chance, lucid will get a namazu2 update to 2.0.21?
(oneiric and precise already have it)

[Jamie Strandboge (jdstrand)]

Thanks for taking the time to report this bug and helping to make Ubuntu better. Since the package referred to in this bug is in universe or multiverse, it is community maintained. If you are able, I suggest posting a debdiff for this issue. When a debdiff is available, members of the security team will review it and publish the package. See the following link for more information: https://wiki.ubuntu.com/SecurityTeam/UpdateProcedures

[NOKUBI Takatsugu (nokubi)]

The following is the security patch for namazu 2.0.20.

http://cvs.namazu.org/namazu/nmz/codeconv.c?r1=1.29.8.8&r2=1.29.8.9&pathrev=stable-2-0&view=patch

[Jamie Strandboge (jdstrand)]

Thanks for giving the patch reference. Because this package is in universe and community maintained, in order for it to be included in Ubuntu, a patch must be prepared against the Ubuntu packages. Please see https://wiki.ubuntu.com/SecurityTeam/SponsorsQueue#Notes_for_Contributors for details.

Unsubscribing ubuntu-security-sponsors. Please feel free to resubscribe after submitting any debdiffs.

[Jamie Strandboge (jdstrand)]

Thank you for reporting this bug to Ubuntu. maverick has reached EOL
(End of Life) and is no longer supported. As a result, this bug
against maverick is being marked "Won't Fix". Please see
https://wiki.ubuntu.com/Releases for currently supported Ubuntu
releases.

Please feel free to report any other bugs you may find.

[Jamie Strandboge (jdstrand)]

Thank you for reporting this bug to Ubuntu. natty has reached EOL
(End of Life) and is no longer supported. As a result, this bug
against natty is being marked "Won't Fix". Please see
https://wiki.ubuntu.com/Releases for currently supported Ubuntu
releases.

Please feel free to report any other bugs you may find.

[Rolf Leggewie (r0lf)]

lucid has seen the end of its life and is no longer receiving any updates. Marking the lucid task for this ticket as "Won't Fix".