Ubuntu
otrs2 package

SRU otrs in 10.04 LTS

  1. Lucid (10.04)
  2. Bug #687953
Bug #687953 reported by Marcus Asshauer
260
This bug affects 1 person
Affects Status Importance Assigned to Milestone
otrs2 (Ubuntu)
Fix Released
Medium
Unassigned
Lucid
Won't Fix
Undecided
Unassigned
Maverick
Won't Fix
Undecided
Unassigned
Natty
Fix Released
Undecided
Unassigned

Bug Description

Binary package hint: otrs2

There is a security problem in version 2.4.7 which is actually used in 10.04. There is a possible XSS attack from HTML e-Mails.

For more information please follow this link: http://otrs.org/releases/2.4.9/

This should be fixed with version 2.4.9 which is packaged for Natty.

CVE References

Revision history for this message
Marc Deslauriers (mdeslaur) wrote :

Thanks for taking the time to report this bug and helping to make Ubuntu better. Since the package referred to in this bug is in universe or multiverse, it is community maintained. If you are able, I suggest posting a debdiff for this issue. When a debdiff is available, members of the security team will review it and publish the package. See the following link for more information: https://wiki.ubuntu.com/SecurityTeam/UpdateProcedures

visibility: private → public
Changed in otrs2 (Ubuntu):
status: New → Confirmed
importance: Undecided → Medium
Revision history for this message
Jamie Strandboge (jdstrand) wrote :

This was fixed in Ubuntu 11.04.

Changed in otrs2 (Ubuntu Natty):
status: New → Fix Released
Changed in otrs2 (Ubuntu Maverick):
status: New → Triaged
Changed in otrs2 (Ubuntu Lucid):
status: New → Triaged
Changed in otrs2 (Ubuntu):
status: Confirmed → Fix Released
Revision history for this message
Jamie Strandboge (jdstrand) wrote :

Thank you for reporting this bug to Ubuntu. maverick has reached EOL
(End of Life) and is no longer supported. As a result, this bug
against maverick is being marked "Won't Fix". Please see
https://wiki.ubuntu.com/Releases for currently supported Ubuntu
releases.

Please feel free to report any other bugs you may find.

Changed in otrs2 (Ubuntu Maverick):
status: Triaged → Won't Fix
Revision history for this message
Rolf Leggewie (r0lf) wrote :

lucid has seen the end of its life and is no longer receiving any updates. Marking the lucid task for this ticket as "Won't Fix".

Changed in otrs2 (Ubuntu Lucid):
status: Triaged → Won't Fix
To post a comment you must log in.
This report contains Public Security information  
Everyone can see this security related information.
Subscribing...

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.