phpgroupware - missing filename sanitising, SQL injection

The authors of phpgroupware, a web based groupware system written in
PHP, discovered several vulnerabilities. The Common Vulnerabilities
and Exposures project identifies the following problems:

• CAN-2004-0016
  In the “calendar” module, “save extension” was not enforced for
  holiday files. As a result, server-side php scripts may be placed
  in directories that then could be accessed remotely and cause the
  webserver to execute those. This was resolved by enforcing the
  extension “.txt” for holiday files.

• CAN-2004-0017
  Some SQL injection problems (non-escaping of values used in SQL
  strings) the “calendar” and “infolog” modules.

Additionally, the Debian maintainer adjusted the permissions on world
writable directories that were accidentally created by former postinst
during the installation.

For the stable distribution (woody) this problem has been fixed in
version 0.9.14-0.RC3.2.woody3.

For the unstable distribution (sid) this problem has been fixed in
version 0.9.14.007-4.

We recommend that you upgrade your phpgroupware, phpgroupware-calendar
and phpgroupware-infolog packages.