FWD: LedgerSMB Security Advisory: Multiple Vulnerabilities

Hi all; It has been brought to our attention that a number of security vulnerabilities have been noted in SQL-Ledger. Several of these affect earlier versions of LedgerSMB, and three hotfixes have been released for problems that continue to affect the LedgerSMB codebase. As always, we highly...

CVE-2009-3583

Directory traversal vulnerability in the Preferences menu item in SQL-Ledger 2.8.24 allows remote attackers to include and execute arbitrary local files via a .. dot dot in the countrycode field...

CVE-2009-3583

Directory traversal vulnerability in the Preferences menu item in SQL-Ledger 2.8.24 allows remote attackers to include and execute arbitrary local files via a .. dot dot in the countrycode field...

CVE-2009-3583

CVE-2009-3583 describes a directory traversal vulnerability in SQL-Ledger 2.8.24. The flaw resides in the Preferences menu item where an attacker can cause local files to be included and executed by supplying a .. (dot dot) sequence in the countrycode field. Public references consistently state t...