psoTFX reports:
phpBB Group are pleased to announce the release of phpBB
2.0.12 the "Horray for Furrywood" release. This release
addresses a number of bugs and a couple of potential
exploits. [...] one of the potential exploits addressed
in this release could be serious in certain situations and
thus we urge all users, as always, to upgrade to this
release as soon as possible. Mostly this release is
concerned with eliminating disclosures of information
which while useful in debug situations may allow third
parties to gain information which could be used to do harm
via unknown or unfixed exploits in this or other
applications.
The ChangeLog for phpBB 2.0.12 states:
- Prevented full path display on critical messages
- Fixed full path disclosure in username handling caused
by a PHP 4.3.10 bug - AnthraX101
- Added exclude list to unsetting globals (if
register_globals is on) -
SpoofedExistence
- Fixed arbitrary file disclosure vulnerability in avatar
handling functions - AnthraX101
- Fixed arbitrary file unlink vulnerability in avatar
handling functions - AnthraX101
- Fixed path disclosure bug in search.php caused by a
PHP 4.3.10 bug (related to AnthraX101's discovery)
- Fixed path disclosure bug in viewtopic.php caused by
a PHP 4.3.10 bug - matrix_killer