CVE-2007-5372 sql injection for authenticated users

Debian Bug report logs - #446366
CVE-2007-5372 sql injection for authenticated users

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Nico Golde <nion@debian.org>

To: submit@bugs.debian.org

Subject: CVE-2007-5372 sql injection for authenticated users

Date: Fri, 12 Oct 2007 16:26:11 +0200

[Message part 1 (text/plain, inline)]

Package: sql-ledger
Severity: important
Tags: security

Hi,
the following CVE (Common Vulnerabilities & Exposures) id was
published for sql-ledger.

CVE-2007-5372[0]:
| Multiple SQL injection vulnerabilities in (a) LedgerSMB 1.0.0 through
| 1.2.7 and (b) DWS Systems SQL-Ledger 2.x allow remote attackers to
| execute arbitrary SQL commands via (1) the invoice quantity field or
| (2) the sort field.

If you fix this vulnerability please also include the CVE id
in your changelog entry.

For further information:
[0] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5372

Kind regards
Nico

-- 
Nico Golde - http://ngolde.de - nion@jabber.ccc.de - GPG: 0x73647CFF
For security reasons, all text in this mail is double-rot13 encrypted.

[Message part 2 (application/pgp-signature, inline)]

Message #10 received at 446366-done@bugs.debian.org (full text, mbox, reply):

From: Nikolai Lusan <nikolai@lusan.id.au>

To: 446366-done@bugs.debian.org

Subject: Version: 2.6.0-1

Date: Wed, 20 Jun 2012 20:33:26 +1000

[Message part 1 (text/plain, inline)]

Version: 2.6.0-1

This was fixed upstream prior to release number 2.6.0.


-- 
Nikolai Lusan <nikolai@lusan.id.au>

[signature.asc (application/pgp-signature, inline)]

Send a report that this bug log contains spam.