openSUSE Security Update : horde4-kronolith (openSUSE-SU-2012:1625-1)

This version update to version 3.0.18 addresses bnc791184: Two sets 3.0.17 and 3.0.18 of XSS flaws CVE-2012-5566 and CVE-2012-5567 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update...

CVE-2012-5566

Multiple cross-site scripting XSS vulnerabilities in Horde Kronolith Calendar Application H4 before 3.0.17, as used in Horde Groupware Webmail Edition before 4.0.8, allow remote attackers to inject arbitrary web script or HTML via the 1 tasks view or 2 search view...

CVE-2012-5566

Affected software: Horde Kronolith (H4) 3.0.x used in Horde Groupware Webmail Edition prior to 4.0.8. Vulnerability: multiple XSS flaws in the tasks view and search view, due to input handling in Kronolith before 3.0.17. Impact: remote attackers can inject arbitrary web script or HTML. Remediatio...