[SECURITY] CVE-2008-0783 and CVE-2008-0784

This bug was fixed in the package cacti - 0.8.7a-2ubuntu1

---------------
cacti (0.8.7a-2ubuntu1) hardy; urgency=low

  * debian/patches/cmd-php-non-unique-hosts.patch:
    - added to fix the "Graph Logic Syntax" Issue (LP: #192201)
  * debian/patches/graph-issue-wrra-specs.patch:
    - added to fix the "Hosts with Duplicate IP Address Not Polled"
      (LP: #192203)
  * debian/patches/CVE-2008-0783_CVE-2008-0784_secfix.patch:
    - added to fix those to security issues (LP: #192199)
  * debian/rules:
    - added cli directory to cp command (LP: #185858)
  * Modify Maintainer value to match the DebianMaintainerField
    specification.

 -- Stephan Hermann <email address hidden> Fri, 15 Feb 2008 19:50:07 +0100

Added CVE 2008-0785 and CVE 2008-0786, please dont upload this now.
patching in progress.

According to jdstrand, it's possible upload this patchs.

For CVE-2008-0785 and CVE-2008-0786 opened new bug (#193744)

This bug was fixed in the package cacti - 0.8.6j-1.1ubuntu0.2

---------------
cacti (0.8.6j-1.1ubuntu0.2) gutsy-security; urgency=low

  * SECURITY UPDATE: (LP: #192199)
    + CVE-2008-0783: Multiple cross-site scripting (XSS) vulnerabilities in
      Cacti 0.8.7 before 0.8.7b and 0.8.6 before 0.8.6k allow remote attackers to
      inject arbitrary web script or HTML via the (1) view_type parameter to
      graph.php, (2) filter parameter to graph_view.php, and (3) action and
      login_username parameters to index.php/login.
    + CVE-2008-0784: graph.php in Cacti 0.8.7 before 0.8.7b and 0.8.6 before
      0.8.6k allows remote attackers to obtain the full path via an invalid
      local_graph_id parameter and other unspecified vectors.
  * debian/patches/11_CVE-2008-0783_CVE-2008-0784.dpatch: applied patch by
    upstream.
    (Link: http://www.cacti.net/downloads/patches/0.8.6j/multiple_vulnerabilities-0.8.6j.patch)
  * References:
    CVE-2008-0783
    CVE-2008-0784

 -- Stephan Hermann <email address hidden> Fri, 15 Feb 2008 20:26:11 +0100

This bug was fixed in the package cacti - 0.8.6i-3ubuntu0.2

---------------
cacti (0.8.6i-3ubuntu0.2) feisty-security; urgency=low

  * SECURITY UPDATE: (LP: #192199)
    + CVE-2008-0783: Multiple cross-site scripting (XSS) vulnerabilities in
      Cacti 0.8.7 before 0.8.7b and 0.8.6 before 0.8.6k allow remote attackers to
      inject arbitrary web script or HTML via the (1) view_type parameter to
      graph.php, (2) filter parameter to graph_view.php, and (3) action and
      login_username parameters to index.php/login.
    + CVE-2008-0784: graph.php in Cacti 0.8.7 before 0.8.7b and 0.8.6 before
      0.8.6k allows remote attackers to obtain the full path via an invalid
      local_graph_id parameter and other unspecified vectors.
  * debian/patches/11_CVE-2008-0783_CVE-2008-0784.dpatch: applied patch by
    upstream. (backported from 0.8.6j)
    (Link: http://www.cacti.net/downloads/patches/0.8.6j/multiple_vulnerabilities-0.8.6j.patch)
  * References:
    CVE-2008-0783
    CVE-2008-0784

 -- Stephan Hermann <email address hidden> Fri, 15 Feb 2008 21:10:36 +0100