It looks like you could make SQL injection with $_POST['host'] or some other variables.

[Lazy]

Binary package hint: smbind

Templates should also use: |escape:'html'

[Lazy (ubuntu-bugs-oittaa)]

Commit.php breaks easily, if you use something like ns1.example.org as primary or secondary NS for the domain example.org, because it can't find A record for it. This patch fixes that problem and speeds up iteration of good zones by many orders of magnitudes.

[Kees Cook (kees)]

Thanks for taking the time to report this bug and helping to make Ubuntu better. Since the package referred to in this bug is in universe or multiverse, it is community maintained. If you are able, I suggest posting a debdiff for this issue. When a debdiff is available, members of the security team will review it and publish the package. See the following link for more information: https://wiki.ubuntu.com/SecurityTeam/UpdateProcedures

[Giuseppe Iuculano (giuseppe-iuculano)]

Hi,

On 02/05/2011 12:30 AM, Kees Cook wrote:
> Since the package referred to in this bug is in universe or
> multiverse, it is community maintained. If you are able, I suggest
> posting a debdiff for this issue. When a debdiff is available, members
> of the security team will review it and publish the package. See the
> following link for more information:
> https://wiki.ubuntu.com/SecurityTeam/UpdateProcedures
>
> ** Changed in: smbind (Ubuntu)
> Status: New => Confirmed
>
> ** Changed in: smbind (Ubuntu)
> Importance: Undecided => Medium
>
> ** Visibility changed to: Public
>

Before making it public, an email to the Debian maintainer or better to
the Debian Security team would be appreciated.

Cheers,
Giuseppe.

[Jamie Strandboge (jdstrand)]

Has upstream been notified?

[Lazy (ubuntu-bugs-oittaa)]

Jamie, yes I notified them two years ago: http://sourceforge.net/tracker/?func=detail&aid=3083361&group_id=101135&atid=629100