Horde Framework: Multiple XSS vulnerabilities
1.
Gentoo Linux Security Advisory
Version Information
| Advisory Reference |
GLSA 200505-01 / Horde |
| Release Date |
May 01, 2005 |
| Latest Revision |
May 01, 2005: 01 |
| Impact |
low |
| Exploitable |
remote |
| Package |
Vulnerable versions |
Unaffected versions |
Architecture(s) |
| www-apps/horde-vacation |
<
2.2.2 |
>=
2.2.2 |
All supported architectures
|
| www-apps/horde-turba |
<
1.2.5 |
>=
1.2.5 |
All supported architectures
|
| www-apps/horde-passwd |
<
2.2.2 |
>=
2.2.2 |
All supported architectures
|
| www-apps/horde-nag |
<
1.1.3 |
>=
1.1.3 |
All supported architectures
|
| www-apps/horde-mnemo |
<
1.1.4 |
>=
1.1.4 |
All supported architectures
|
| www-apps/horde-kronolith |
<
1.1.4 |
>=
1.1.4 |
All supported architectures
|
| www-apps/horde-imp |
<
3.2.8 |
>=
3.2.8 |
All supported architectures
|
| www-apps/horde-accounts |
<
2.1.2 |
>=
2.1.2 |
All supported architectures
|
| www-apps/horde-forwards |
<
2.2.2 |
>=
2.2.2 |
All supported architectures
|
| www-apps/horde-chora |
<
1.2.3 |
>=
1.2.3 |
All supported architectures
|
| www-apps/horde |
<
2.2.8 |
>=
2.2.8 |
All supported architectures
|
Related bugreports:
#90365
Synopsis
Various modules of the Horde Framework are vulnerable to multiple
cross-site scripting (XSS) vulnerabilities.
2.
Impact Information
Background
The Horde Framework is a PHP based framework for building web
applications. It provides many modules including calendar, address
book, CVS viewer and Internet Messaging Program.
Description
Cross-site scripting vulnerabilities have been discovered in
various modules of the Horde Framework.
Impact
These vulnerabilities could be exploited by an attacker to execute
arbitrary HTML and script code in context of the victim's browser.
3.
Resolution Information
Workaround
There is no known workaround at this time.
Resolution
All Horde users should upgrade to the latest version:
Code Listing 3.1: Resolution |
# emerge --sync
# emerge --ask --oneshot --verbose ">=www-apps/horde-2.2.8"
|
All Horde Vacation users should upgrade to the latest version:
Code Listing 3.2: Resolution |
# emerge --sync
# emerge --ask --oneshot --verbose ">=www-apps/horde-vacation-2.2.2"
|
All Horde Turba users should upgrade to the latest version:
Code Listing 3.3: Resolution |
# emerge --sync
# emerge --ask --oneshot --verbose ">=www-apps/horde-turba-1.2.5"
|
All Horde Passwd users should upgrade to the latest version:
Code Listing 3.4: Resolution |
# emerge --sync
# emerge --ask --oneshot --verbose ">=www-apps/horde-passwd-2.2.2"
|
All Horde Nag users should upgrade to the latest version:
Code Listing 3.5: Resolution |
# emerge --sync
# emerge --ask --oneshot --verbose ">=www-apps/horde-nag-1.1.3"
|
All Horde Mnemo users should upgrade to the latest version:
Code Listing 3.6: Resolution |
# emerge --sync
# emerge --ask --oneshot --verbose ">=www-apps/horde-mnemo-1.1.4"
|
All Horde Kronolith users should upgrade to the latest version:
Code Listing 3.7: Resolution |
# emerge --sync
# emerge --ask --oneshot --verbose ">=www-apps/horde-kronolith-1.1.4"
|
All Horde IMP users should upgrade to the latest version:
Code Listing 3.8: Resolution |
# emerge --sync
# emerge --ask --oneshot --verbose ">=www-apps/horde-imp-3.2.8"
|
All Horde Accounts users should upgrade to the latest version:
Code Listing 3.9: Resolution |
# emerge --sync
# emerge --ask --oneshot --verbose ">=www-apps/horde-accounts-2.1.2"
|
All Horde Forwards users should upgrade to the latest version:
Code Listing 3.10: Resolution |
# emerge --sync
# emerge --ask --oneshot --verbose ">=www-apps/horde-forwards-2.2.2"
|
All Horde Chora users should upgrade to the latest version:
Code Listing 3.11: Resolution |
# emerge --sync
# emerge --ask --oneshot --verbose ">=www-apps/horde-chora-1.2.3"
|
4.
References
|
