sql-ledger

Several remote vulnerabilities have been discovered in SQL Ledger, a web
based double-entry accounting program, which may lead to the execution
of arbitrary code. The Common Vulnerabilities and Exposures project
identifies the following problems:

• CVE-2006-4244
  Chris Travers discovered that the session management can be tricked
  into hijacking existing sessions.
• CVE-2006-4731
  Chris Travers discovered that directory traversal vulnerabilities
  can be exploited to execute arbitrary Perl code.
• CVE-2006-5872
  It was discovered that missing input sanitising allows execution of
  arbitrary Perl code.

For the stable distribution (sarge) these problems have been fixed in
version 2.4.7-2sarge1.

For the upcoming stable distribution (etch) these problems have been
fixed in version 2.6.21-1.

For the unstable distribution (sid) these problems have been fixed in
version 2.6.21-1.

We recommend that you upgrade your sql-ledger packages.