Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 489948 - www-apps/horde-mnemo : Note Manager Deleting Notepads Cross-Site Scripting Vulnerability
Summary: www-apps/horde-mnemo : Note Manager Deleting Notepads Cross-Site Scripting Vu...
Status: RESOLVED FIXED
Alias: None
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal minor (vote)
Assignee: Gentoo Security
URL: http://secunia.com/advisories/55502/
Whiteboard: B4 [noglsa]
Keywords:
Depends on:
Blocks:
 
Reported: 2013-10-31 09:30 UTC by Agostino Sarubbo
Modified: 2016-06-12 00:33 UTC (History)
1 user (show)

See Also:
Package list:
Runtime testing required: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Agostino Sarubbo gentoo-dev 2013-10-31 09:30:16 UTC
Description

A vulnerability has been reported in Mnemo module for Horde, which can be exploited by malicious people to conduct cross-site scripting attacks.

Certain unspecified input related to deleting notepads is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

The vulnerability is reported in versions prior to 4.1.2.


Solution:
Update to version 4.1.2.

Provided and/or discovered by:
Reported by the vendor.

Original Advisory:
Horde Project:
http://lists.horde.org/archives/announce/2013/000963.html
https://github.com/horde/horde/blob/bdfbe5484cc1dd6aa13c3d5e2401a1f107e81965/mnemo/docs/CHANGES
Comment 1 Aaron Bauman (RETIRED) gentoo-dev 2016-03-14 13:46:32 UTC
# Aaron Bauman <bman@gentoo.org> (05 Mar 2016)
# Per security bug #399563, #489946, #489948, and
# #490422 these packages are vulnerable
# and unmaintained.  Removal in 30 days.
www-apps/horde
www-apps/horde-chora
www-apps/horde-dimp
www-apps/horde-gollem
www-apps/horde-hermes
www-apps/horde-imp
www-apps/horde-ingo
www-apps/horde-jeta
www-apps/horde-kronolith
www-apps/horde-mimp
www-apps/horde-mnemo
www-apps/horde-nag
www-apps/horde-passwd
www-apps/horde-pear
www-apps/horde-turba
Comment 2 Pacho Ramos gentoo-dev 2016-06-11 20:52:30 UTC
this was removed
Comment 3 Aaron Bauman (RETIRED) gentoo-dev 2016-06-12 00:33:39 UTC
Package was removed from tree.