[IT-SecurityNotifies] [announce] OTRS Security Advisory 2010-03: OTRS 2.4.9 (Aitutaki Beach)

[Hauke Böttcher <hauke.boettcher AT otrs.com>]

Dear Community Members,

++++++++++ OTRS Security Advisory 2010-03 OTRS 2.4.9 ++++++++++

Release:            OTRS 2.4.9
Status:             stable
Code Name:          Aitutaki Beach

SECURITY FIXES:
===============

---------------------------------------------------------------

 OTRS Security Advisory 2010-03            <security AT otrs.org>

---------------------------------------------------------------

 ID:         OSA-2010-03

 Date:       2010-10-25

 Title:      AgentTicketZoom is vulnerable to XSS attacks from 

             HTML e-mails

 Severity:   Less critical

 Product:    OTRS 2.4.x

 Fixed in:   OTRS 2.4.9

 URL:        http://otrs.org/advisory/OSA-2010-03-en/

---------------------------------------------------------------

To read the entire Security Advisory please follow this link:

http://otrs.org/advisory/OSA-2010-03-en/

BUG FIXES:
==========

* Bug#6016 - AgentTicketZoom is vunerable to XSS attacks from HTML

             e-mails.

              [ http://bugs.otrs.org/show_bug.cgi?id=6016 ]

* Bug#5903 - E-mail notification links don't contain <a href… 

             tags.

              [ http://bugs.otrs.org/show_bug.cgi?id=5903 ]

* Bug#6030 - Event notifications get's fired several times on 

             event "TicketFreeTextUpdate".

              [ http://bugs.otrs.org/show_bug.cgi?id=6030 ]

* Bug#5941 - Error in Apache log occured when no tickets and/or 

             customers are in the dashboard.

              [ http://bugs.otrs.org/show_bug.cgi?id=5941 ]

* Bug#5541 - Dashboard Chart generates error in webserver log.

              [ http://bugs.otrs.org/show_bug.cgi?id=5541 ]

* Bug#5462 - Kernel::System::Ticket::TicketEscalationIndexBuild()

             does not invalidate the cache.

              [ http://bugs.otrs.org/show_bug.cgi?id=5462 ]

* Bug#5667 - Rich Text is not working in ipad. It's not possible 

             to add a note or close a ticket.

              [ http://bugs.otrs.org/show_bug.cgi?id=5667 ]

* Bug#5266 - Ticket Zoom shows wrong html content if there is no 

             text but two html attachments in there.

              [ http://bugs.otrs.org/show_bug.cgi?id=5266 ]

MD5 CHECKSUMS:
==============

2fcf15fe8a7e7413dd8aa69d0a7420e7

http://ftp.otrs.org/pub/otrs/RPMS/suse/7.3/otrs-2.4.9-01.noarch.rpm

0d7d3197f0de75c36be59ddffc6cf7e7

http://ftp.otrs.org/pub/otrs/RPMS/suse/8.x/otrs-2.4.9-01.noarch.rpm

a553feacc4f5a99fa6187d18a271d743

http://ftp.otrs.org/pub/otrs/RPMS/suse/9.0/otrs-2.4.9-01.noarch.rpm

967b68a167f1024016a13ff09ef3ec6d

http://ftp.otrs.org/pub/otrs/RPMS/suse/9.1/otrs-2.4.9-01.noarch.rpm

3a1056434ab487c29f0a4872fa9f2db9

http://ftp.otrs.org/pub/otrs/RPMS/suse/10.0/otrs-2.4.9-01.noarch.rpm

9db398bb0edc46c19daad323ce103aa2

http://ftp.otrs.org/pub/otrs/RPMS/suse/11.0/otrs-2.4.9-01.noarch.rpm

6ab8e0571538cd618e81ecc5d922adf3

http://ftp.otrs.org/pub/otrs/RPMS/fedora/4/otrs-2.4.9-01.noarch.rpm

e1f74424f3004257a16b63346da26eb7

http://ftp.otrs.org/pub/otrs/RPMS/redhat/7.x/otrs-2.4.9-01.noarch.rpm

0cca890de367c4c3f7697442dfa2eb8a

http://ftp.otrs.org/pub/otrs/RPMS/redhat/8.0/otrs-2.4.9-01.noarch.rpm

0719e6e35d22f92d01de06df2c360361

http://ftp.otrs.org/pub/otrs/otrs-2.4.9.tar.gz

bf0aa646ae8670bc9f8bfa3a67e74f12

http://ftp.otrs.org/pub/otrs/otrs-2.4.9.tar.bz2

7459d171b9295bc3c81d86e454771290

http://ftp.otrs.org/pub/otrs/otrs-2.4.9.zip

c2f1bba1ba984da6d605b9900cb4db58

http://ftp.otrs.org/pub/otrs/otrs-2.4.9-win-installer-2.3.1.exe

SOFTWARE DOWNLOAD: 

===================

Please note that we have relaunched our website www.otrs.com.

The software can now be downloaded exclusively  

* http://otrs.org/download/

* http://otrs.org/download/#otrs3
* ftp://ftp.otrs.org/pub/otrs/ (Germany/Hamburg)

A complete list of all download mirrors (ftp/http/rsync) is 

available at http://otrs.org/download/

YOUR CONTRIBUTION:

===================

* Please send information regarding vulnerabilities in OTRS to

  security AT otrs.org.

* We kindly ask for your assistance to update the translation 

  files! The current status can be found here: 

  http://users.otrs.com/~me/i18n/

FEEDBACK & BUG REPORTING: 

========================= 

Although OTRS 2.4.9 has been tested before, we appreciate

your contributions. As always, you’re encouraged to tell 

us what you think, using this feedback e-Mail: [enjoy at otrs.com] 

or by filing a bug in Bugzilla [http://bugs.otrs.org].

--


Hauke Jan Böttcher
Director Marketing

OTRS AG
Norsk-Data-Straße 1
61352 Bad Homburg
Germany

T: +49 (0) 6172 681988 0
F: +49 (0) 9421 56818 18
I:  http://www.otrs.com/

Business Location: Bad Homburg
Country Court: Bad Homburg, HRB 10751
VAT ID: DE256610065
Chairman: Burchard Steinbild
Managing Board: André Mindermann (CEO)

---------------------------------------------------------------------
OTRS mailing list: announce - Webpage: http://otrs.org/
Archive: http://lists.otrs.org/pipermail/announce
To unsubscribe: http://lists.otrs.org/cgi-bin/listinfo/announce