Some vulnerabilities have been reported in Flyspray, which can be exploited by malicious people to bypass certain security restrictions and to disclose sensitive information.

1) The vulnerability is caused due to an unspecified error, which can be exploited to gain administrator access.

Successful exploitation requires that "output_buffering" is disabled or set to a low value.

2) The vulnerability is caused due to an unspecified error, which can be exploited to display project summaries of private projects.

The vulnerabilities are reported in version 0.9.9. Prior versions may also be affected.

Solution
Update to version 0.9.9.1.

Provided and/or discovered by
1) Stefan Esser, Hardened-PHP Project.
2) Reported by the vendor.

Changelog
Further details available to Secunia VIM customers

Original Advisory
1) Flyspray Security Announcement 1:
http://www.flyspray.org/fsa:1

2) Flyspray Changelog:
http://www.flyspray.org/changelog

Deep Links
Links available to Secunia VIM customers