Debian Security Advisory 1056-1: David Maciejak noticed that webcalendar, a PHP-Based multi-user calendar, returns different error messages on login attempts for an invalid password and a non-existing user, allowing remote attackers to gain information about valid usernames.
You can download this advisory from the following link: https://packetstormsecurity.com/files/download/46325/dsa-1056-1.txt
Source: https://packetstormsecurity.com/files/46325/Debian-Linux-Security-Advisory-1056-1.html