Debian DLA-2350-1 : php-horde-kronolith security update

In Horde Groupware, there has been an XSS via the Name field during creation of a new Resource. This could have been leveraged for remote code execution after compromising an administrator account, because the CVE-2015-7984 CSRF protection mechanism can then be bypassed. For Debian 9 stretch, thi...

Debian DLA-2351-1 : php-horde-kronolith security update

In Horde Groupware, there has been an XSS vulnerability that could be exploited via the URL field in a 'Calendar - New Event' action. For Debian 9 stretch, this problem has been fixed in version 4.2.19-1+deb9u2. We recommend that you upgrade your php-horde-kronolith packages. For the detailed...

Debian DLA-2349-1 : php-horde security update

In Horde Groupware, there has been an XSS vulnerability in two components via the Color field in a Create Task List action. For Debian 9 stretch, this problem has been fixed in version 5.2.13+debian0-1+deb9u3. We recommend that you upgrade your php-horde packages. For the detailed security status...

Debian DLA-2348-1 : php-horde-core security update

In Horde Groupware, there has been an XSS vulnerability in two components via the Color field in a Create Task List action. For Debian 9 stretch, this problem has been fixed in version 2.27.6+debian1-2+deb9u1. We recommend that you upgrade your php-horde-core packages. For the detailed security...

Debian DLA-2352-1 : php-horde-gollem security update

The File Manager gollem module in Horde Groupware has allowed remote attackers to bypass Horde authentication for file downloads via a crafted fn parameter that corresponded to the exact filename. For Debian 9 stretch, this problem has been fixed in version 3.0.10-1+deb9u2. We recommend that you...

Debian: Security Advisory (DLA-2349-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian: Security Advisory (DLA-2351-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian: Security Advisory (DLA-2352-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian: Security Advisory (DLA-2348-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian: Security Advisory (DLA-2350-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] [DLA 2352-1] php-horde-gollem security update

Debian LTS Advisory DLA-2352-1 [email protected] https://www.debian.org/lts/security/ Mike Gabriel August 29, 2020 https://wiki.debian.org/LTS Package : php-horde-gollem Version : 3.0.10-1+deb9u2 CVE ID : CVE-2017-15235 The File Manager gollem module in Horde Groupware has allowed remot...

[SECURITY] [DLA 2351-1] php-horde-kronolith security update

Debian LTS Advisory DLA-2351-1 [email protected] https://www.debian.org/lts/security/ Mike Gabriel August 29, 2020 https://wiki.debian.org/LTS Package : php-horde-kronolith Version : 4.2.19-1+deb9u2 CVE ID : CVE-2017-16906 Debian Bug : 909737 In Horde Groupware, there has been an XSS...

[SECURITY] [DLA 2349-1] php-horde security update

Debian LTS Advisory DLA-2349-1 [email protected] https://www.debian.org/lts/security/ Mike Gabriel August 29, 2020 https://wiki.debian.org/LTS Package : php-horde Version : 5.2.13+debian0-1+deb9u3 CVE ID : CVE-2017-16907 Debian Bug : 909739 In Horde Groupware, there has been an XSS...

[SECURITY] [DLA 2348-1] php-horde-core security update

Debian LTS Advisory DLA-2348-1 [email protected] https://www.debian.org/lts/security/ Mike Gabriel August 29, 2020 https://wiki.debian.org/LTS Package : php-horde-core Version : 2.27.6+debian1-2+deb9u1 CVE ID : CVE-2017-16907 Debian Bug : 909800 In Horde Groupware, there has been an XSS...

DLA-2350-1 php-horde-kronolith - security update

Bulletin has no description...

DLA-2351-1 php-horde-kronolith - security update

Bulletin has no description...

DLA-2349-1 php-horde - security update

Bulletin has no description...

DLA-2352-1 php-horde-gollem - security update

Bulletin has no description...

DLA-2348-1 php-horde-core - security update

Bulletin has no description...

(0Day) Horde Groupware Webmail Edition Horde last_logintasks Deserialization of Untrusted Data Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Horde Groupware Webmail Edition. Authentication is required to exploit this vulnerability. The specific flaw exists within Horde.php. When parsing the lastlogintasks parameter, the process does not...