262978 – (CVE-2009-0931) <www-apps/horde-3.3.4 and <www-apps/horde-groupware-1.2.3 arbitrary HTML/script injection (CVE-2009-{0931,0932})

Bug 262978 (CVE-2009-0931) - <www-apps/horde-3.3.4 and <www-apps/horde-groupware-1.2.3 arbitrary HTML/script injection (CVE-2009-{0931,0932})

Summary: <www-apps/horde-3.3.4 and <www-apps/horde-groupware-1.2.3 arbitrary HTML/scri...

Status:	RESOLVED FIXED

Alias:	CVE-2009-0931

Product:	Gentoo Security
Classification:	Unclassified
Component:	Vulnerabilities (show other bugs)
Hardware:	All Linux

Importance:	High major (vote)
Assignee:	Gentoo Security

URL:	http://cvs.horde.org/co.php/horde/doc...
Whiteboard:	B1 [glsa]
Keywords:

Depends on:
Blocks:

Reported:	2009-03-19 00:04 UTC by Stefan Behte (RETIRED)
Modified:	2009-09-12 16:33 UTC (History)
CC List:	3 users (show)

See Also:
Package list:
Runtime testing required:	---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description Stefan Behte (RETIRED) gentoo-dev

2009-03-19 00:04:19 UTC

CVE-2009-0931 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-0931):
  Cross-site scripting (XSS) vulnerability in the tag cloud search
  script (horde/services/portal/cloud_search.php) in Horde before 3.2.4
  and 3.3.3, and Horde Groupware before 1.1.5, allows remote attackers
  to inject arbitrary web script or HTML via unspecified vectors.

Comment 1 Stefan Behte (RETIRED) gentoo-dev

2009-03-19 00:09:57 UTC

CVE-2009-0932 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-0932):
  Directory traversal vulnerability in framework/Image/Image.php in
  Horde before 3.2.4 and 3.3.3 and Horde Groupware before 1.1.5 allows
  remote attackers to include and execute arbitrary local files via
  directory traversal sequences in the Horde_Image driver name.

Comment 2 Alex Legler (RETIRED) archtester

2009-08-24 13:41:16 UTC

Horde stabling via bug 256125.

Comment 3 Alex Legler (RETIRED) archtester

2009-08-24 13:57:58 UTC

+*horde-groupware-1.2.3 (24 Aug 2009)
+
+  24 Aug 2009; Alex Legler <a3li@gentoo.org> -horde-groupware-1.0.7.ebuild,
+  -horde-groupware-1.1.3.ebuild, -horde-groupware-1.2.ebuild,
+  +horde-groupware-1.2.3.ebuild:
+  Non-maintainer commit: Version bump for security bug 262978. Removing
+  vulnerable versions.

~arch only

Comment 4 Alex Legler (RETIRED) archtester

2009-09-02 09:51:09 UTC

This includes file inclusion -> B1 -> GLSA draft filed.

Comment 5 Alex Legler (RETIRED) archtester

2009-09-12 16:33:07 UTC

GLSA 200909-14