Multiple vulnerabilities and a security issue have been reported in Roundup, some of which have unknown impacts, while others can be exploited by malicious users to bypass certain security restrictions.

1) An error exists in the xml-rpc server when enforcing restrictions set on properties. This can be exploited to edit or view restricted properties via the "list", "display", and "set" methods.

The security issue is reported in version 1.4.4. Other versions may also be affected.

2) Multiple vulnerabilities are caused due to an unspecified errors. No further information is currently available.

The vulnerabilities are reported in versions prior to 1.4.4.

Solution
Update to version 1.4.4, which fixes vulnerability #2.
Further details available in Customer Area

Provided and/or discovered by
1) Reported by Philipp Gortan in a Roundup bug report.
2) The vendor credits Roland Meister.

Changelog
Further details available in Customer Area

Original Advisory
http://sourceforge.net/tracker/index.php?func=detail&aid=1907211&group_id=31577&atid=402788
http://roundup.cvs.sourceforge.net/roundup/roundup/CHANGES.txt?view=markup&content-type=text/vnd.viewcvs-markup&revision=HEAD

Deep Links
Links available in Customer Area