Helmut Grohne discovered multiple privilege escalation flaws in FusionForge, a web-based project-management and collaboration software. Most of the vulnerabilities are related to the bad handling of privileged operations on user-controlled files or directories.

For the stable distribution (squeeze), this problem has been fixed in version 5.0.2-5+squeeze2. For the testing (wheezy) and unstable (sid) distribution, these problems will be fixed soon. We recommend that you upgrade your fusionforge packages.

FusionForge provides many tools to aid collaboration in a development project, such as bug-tracking, task management, mailing-lists, SCM repository, forums, support request helper, web/FTP hosting, release management, etc. All these services are integrated into one web site and managed through a web interface.

fusionforge on Debian Linux

This check tests the installed software version using the apt package manager.

• http://www.debian.org/security/2013/dsa-2633.html

---

Updated on 2015-03-25