As a result, an upgrade to the latest version would be recommended for security-conscious sites. A heap overflow is reportedly triggerable via the man command on some Linux distributions. The exploitability of the vulnerability has been questioned and is definitely dependent on whether or not the man command is installed setgid group man. Exploits for two sendfile vulnerabilities were published this week. PHPProjekt 2.1 and earlier have been reported to contain a directory transversal vulnerability.
Patches are available.
Version 2.1a is not affected. PHPSlash , a PHP-based Slash clone , has been reported to be vulnerable to a directory transversal vulnerability . A patch to fix the problem is provided. DCForum 2000 1.0 and DCForum Version 6.0 have been reported to be vulnerable to a password file manipulation vulnerability . The vendor has issued an advisory and patches to fix the problem.