Ansgar Burchardt, Mike O"Connor and Philipp Kern discovered multiple vulnerabilities in DTC, a web control panel for admin and accounting hosting services: CVE-2011-3195 A possible shell insertion has been found in the mailing list handling. CVE-2011-3196 Unix rights for the apache2.conf were set incorrectly . CVE-2011-3197 Incorrect input sanitising for the $_SERVER["addrlink"] parameter could lead to SQL insertion. CVE-2011-3198 DTC was using the -b option of htpasswd, possibly revealing password in clear text using ps or reading /proc. CVE-2011-3199 A possible HTML/javascript insertion vulnerability has been found in the DNS & MX section of the user panel. This update also fixes several vulnerabilities, for which no CVE ID has been assigned: It has been discovered that DTC performs insufficient input sanitising in the package installer, leading to possible unwanted destination directory for installed packages if some DTC application packages are installed . DTC was setting-up /etc/sudoers with permissive sudo rights to chrootuid. Incorrect input sanitizing in the package installer could lead to SQL insertion. A malicious user could enter a specially crafted support ticket subject leading to an SQL injection in the draw_user_admin.php.