elog

Several remote vulnerabilities have been discovered in elog, a web-based
electronic logbook, which may lead to the execution of arbitrary code.
The Common Vulnerabilities and Exposures project identifies the following
problems:

• CVE-2006-5063
  Tilman Koschnick discovered that log entry editing in HTML is vulnerable
  to cross-site scripting. This update disables the vulnerable code.
• CVE-2006-5790
  Ulf Härnhammar of the Debian Security Audit Project discovered several
  format string vulnerabilities in elog, which may lead to execution of
  arbitrary code.
• CVE-2006-5791
  Ulf Härnhammar of the Debian Security Audit Project discovered
  cross-site scripting vulnerabilities in the creation of new logbook
  entries.
• CVE-2006-6318
  Jayesh KS and Arun Kethipelly of OS2A discovered that elog performs
  insufficient error handling in config file parsing, which may lead to
  denial of service through a NULL pointer dereference.

For the stable distribution (sarge) these problems have been fixed in
version 2.5.7+r1558-4+sarge3.

The upcoming stable distribution (etch) will no longer include elog.

For the unstable distribution (sid) these problems have been fixed in
version 2.6.2+r1754-1.

We recommend that you upgrade your elog package.