Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 262978 (CVE-2009-0931) - <www-apps/horde-3.3.4 and <www-apps/horde-groupware-1.2.3 arbitrary HTML/script injection (CVE-2009-{0931,0932})
Summary: <www-apps/horde-3.3.4 and <www-apps/horde-groupware-1.2.3 arbitrary HTML/scri...
Status: RESOLVED FIXED
Alias: CVE-2009-0931
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: High major (vote)
Assignee: Gentoo Security
URL: http://cvs.horde.org/co.php/horde/doc...
Whiteboard: B1 [glsa]
Keywords:
Depends on:
Blocks:
 
Reported: 2009-03-19 00:04 UTC by Stefan Behte (RETIRED)
Modified: 2009-09-12 16:33 UTC (History)
3 users (show)

See Also:
Package list:
Runtime testing required: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Stefan Behte (RETIRED) gentoo-dev Security 2009-03-19 00:04:19 UTC
CVE-2009-0931 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-0931):
  Cross-site scripting (XSS) vulnerability in the tag cloud search
  script (horde/services/portal/cloud_search.php) in Horde before 3.2.4
  and 3.3.3, and Horde Groupware before 1.1.5, allows remote attackers
  to inject arbitrary web script or HTML via unspecified vectors.
Comment 1 Stefan Behte (RETIRED) gentoo-dev Security 2009-03-19 00:09:57 UTC
CVE-2009-0932 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-0932):
  Directory traversal vulnerability in framework/Image/Image.php in
  Horde before 3.2.4 and 3.3.3 and Horde Groupware before 1.1.5 allows
  remote attackers to include and execute arbitrary local files via
  directory traversal sequences in the Horde_Image driver name.

Comment 2 Alex Legler (RETIRED) archtester Gentoo Infrastructure gentoo-dev Security 2009-08-24 13:41:16 UTC
Horde stabling via bug 256125.
Comment 3 Alex Legler (RETIRED) archtester Gentoo Infrastructure gentoo-dev Security 2009-08-24 13:57:58 UTC
+*horde-groupware-1.2.3 (24 Aug 2009)
+
+  24 Aug 2009; Alex Legler <a3li@gentoo.org> -horde-groupware-1.0.7.ebuild,
+  -horde-groupware-1.1.3.ebuild, -horde-groupware-1.2.ebuild,
+  +horde-groupware-1.2.3.ebuild:
+  Non-maintainer commit: Version bump for security bug 262978. Removing
+  vulnerable versions.

~arch only
Comment 4 Alex Legler (RETIRED) archtester Gentoo Infrastructure gentoo-dev Security 2009-09-02 09:51:09 UTC
This includes file inclusion -> B1 -> GLSA draft filed.
Comment 5 Alex Legler (RETIRED) archtester Gentoo Infrastructure gentoo-dev Security 2009-09-12 16:33:07 UTC
GLSA 200909-14