Bug 489946

Summary:	www-apps/horde-nag : Deleting Task Lists Cross-Site Scripting Vulnerabilities
Product:	Gentoo Security	Reporter:	Agostino Sarubbo <ago>
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	RESOLVED FIXED
Severity:	minor	CC:	web-apps
Priority:	Normal
Version:	unspecified
Hardware:	All
OS:	Linux
URL:	http://secunia.com/advisories/55397/
Whiteboard:	B4 [noglsa]
Package list:		Runtime testing required:	---

Description Agostino Sarubbo gentoo-dev

2013-10-31 09:27:45 UTC

Description

Some vulnerabilities have been reported in Nag module for Horde, which can be exploited by malicious people to conduct cross-site scripting attacks.

Certain unspecified input related to deleting task lists is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

The vulnerability is reported in versions prior to 4.1.3.


Solution:
Update to version 4.1.3.

Provided and/or discovered by:
Reported by the vendor.

Original Advisory:
Horde Project:
http://lists.horde.org/archives/announce/2013/000962.html
https://github.com/horde/horde/blob/dba2684dcd4bf369bbde56a0599e6b4cda591177/nag/docs/CHANGES

Comment 1 Aaron Bauman (RETIRED) gentoo-dev

2016-03-14 13:46:52 UTC

# Aaron Bauman <bman@gentoo.org> (05 Mar 2016)
# Per security bug #399563, #489946, #489948, and
# #490422 these packages are vulnerable
# and unmaintained.  Removal in 30 days.
www-apps/horde
www-apps/horde-chora
www-apps/horde-dimp
www-apps/horde-gollem
www-apps/horde-hermes
www-apps/horde-imp
www-apps/horde-ingo
www-apps/horde-jeta
www-apps/horde-kronolith
www-apps/horde-mimp
www-apps/horde-mnemo
www-apps/horde-nag
www-apps/horde-passwd
www-apps/horde-pear
www-apps/horde-turba

Comment 2 Pacho Ramos gentoo-dev

2016-06-11 20:52:18 UTC

this was removed

Comment 3 Aaron Bauman (RETIRED) gentoo-dev

2016-06-12 00:34:30 UTC

Package was removed from tree.