Gallery 1.5.2-pl2 Security Release

Gallery is a slick, intuitive web based photo gallery with authenticated 
users and privileged albums. Easy to install, configure and use. Photo 
management includes automatic thumbnails, resizing, rotation, etc. User 
privileges make this great for communities.

Gallery 1.5.2-pl2 is now available for download. This release fixes 
several things:

     * A very major data loss issue with the zip download component. If 
a zip file is not successfully created, Gallery 1.5.2 and Gallery 
1.5.2-pl1 will try and delete many more files than they should.
     * A very minor security problem where a user with write access to a 
server could create a specially formatted file, coerce someone with 
owner privileges in the Gallery to click on a specially formatted link, 
which could modify stored album data and possibly lead to local code 
execution. We thank Tom Saville (seregon at bughunter dot net) and his 
team from <http://digitalarmaments.com> for reporting this us and giving 
us time to get a patch out.

We Strongly Recommend all Gallery 1.5.2 users upgrade immediately to 
1.5.2-pl2 to avoid loosing data on your webserver!
Download Gallery 1.5.2-pl2 from 
<http://sf.net/project/showfiles.php?group_id=7130&package_id=7239>

Get all the details at 
<http://gallery.menalto.com/gallery_1_5_2_pl2_security_release>

-- 
Chris Kelly
[email protected]
http://ckdake.com/


-------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc. Do you grep through log files
for problems?  Stop!  Download the new AJAX search engine that makes
searching your log files as easy as surfing the  web.  DOWNLOAD SPLUNK!
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=103432&bid=230486&dat=121642
__[ g a l l e r y - a n n o u n c e ]_________________________

[ list info/archive --> http://gallery.sf.net/lists.php ]
[ gallery info/FAQ/download --> http://gallery.sf.net ]