Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!

Bug 262978 (CVE-2009-0931)

Summary: <www-apps/horde-3.3.4 and <www-apps/horde-groupware-1.2.3 arbitrary HTML/script injection (CVE-2009-{0931,0932})
Product: Gentoo Security Reporter: Stefan Behte (RETIRED) <craig>
Component: VulnerabilitiesAssignee: Gentoo Security <security>
Status: RESOLVED FIXED    
Severity: major CC: glua, web-apps, wrobel
Priority: High    
Version: unspecified   
Hardware: All   
OS: Linux   
URL: http://cvs.horde.org/co.php/horde/docs/CHANGES?r=1.515.2.503
Whiteboard: B1 [glsa]
Package list:
Runtime testing required: ---

Description Stefan Behte (RETIRED) gentoo-dev Security 2009-03-19 00:04:19 UTC 
CVE-2009-0931 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-0931):
  Cross-site scripting (XSS) vulnerability in the tag cloud search
  script (horde/services/portal/cloud_search.php) in Horde before 3.2.4
  and 3.3.3, and Horde Groupware before 1.1.5, allows remote attackers
  to inject arbitrary web script or HTML via unspecified vectors.
Comment 1 Stefan Behte (RETIRED) gentoo-dev Security 2009-03-19 00:09:57 UTC 
CVE-2009-0932 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-0932):
  Directory traversal vulnerability in framework/Image/Image.php in
  Horde before 3.2.4 and 3.3.3 and Horde Groupware before 1.1.5 allows
  remote attackers to include and execute arbitrary local files via
  directory traversal sequences in the Horde_Image driver name.
Comment 2 Alex Legler (RETIRED) archtester gentoo-dev Security 2009-08-24 13:41:16 UTC 
Horde stabling via bug 256125.
Comment 3 Alex Legler (RETIRED) archtester gentoo-dev Security 2009-08-24 13:57:58 UTC 
+*horde-groupware-1.2.3 (24 Aug 2009)
+
+  24 Aug 2009; Alex Legler <a3li@gentoo.org> -horde-groupware-1.0.7.ebuild,
+  -horde-groupware-1.1.3.ebuild, -horde-groupware-1.2.ebuild,
+  +horde-groupware-1.2.3.ebuild:
+  Non-maintainer commit: Version bump for security bug 262978. Removing
+  vulnerable versions.

~arch only
Comment 4 Alex Legler (RETIRED) archtester gentoo-dev Security 2009-09-02 09:51:09 UTC 
This includes file inclusion -> B1 -> GLSA draft filed.
Comment 5 Alex Legler (RETIRED) archtester gentoo-dev Security 2009-09-12 16:33:07 UTC 
GLSA 200909-14