CVE-2014-0103

CVE-2014-0103 affects Zarafa WebAccess (and WebApp) prior to version 7.1.10 / 1.6, where credentials are stored in cleartext in PHP session files. This enables local Apache users to read sensitive information. OpenVAS advisories link CVE-2014-0103 to multiple Zarafa updates; Fedora/MGASA advisori...

CVE-2014-0103

WebAccess in Zarafa before 7.1.10 and WebApp before 1.6 stores credentials in cleartext, which allows local Apache users to obtain sensitive information by reading the PHP session files...

[SECURITY] Fedora 19 Update: zarafa-7.1.10-2.fc19

The Zarafa Collaboration Platform is a Microsoft Exchange replacement. The Open Source Collaboration provides an integration with your existing Linux mail server, native mobile phone support by ActiveSync compatibility and a webaccess with 'Look & Feel' similar to Outlook using Ajax. Including an...

[SECURITY] Fedora 20 Update: zarafa-7.1.10-2.fc20

The Zarafa Collaboration Platform is a Microsoft Exchange replacement. The Open Source Collaboration provides an integration with your existing Linux mail server, native mobile phone support by ActiveSync compatibility and a webaccess with 'Look & Feel' similar to Outlook using Ajax. Including an...

Fedora Update for zarafa FEDORA-2014-7889

The remote host is missing an update for the SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora 19 : zarafa-7.1.10-2.fc19 (2014-7889)

Zarafa Collaboration Platform 7.1.10 final 44973 ================================================== General Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as mu...

Fedora 20 : zarafa-7.1.10-2.fc20 (2014-7896)

Zarafa Collaboration Platform 7.1.10 final 44973 ================================================== General Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as mu...

Fedora Update for zarafa FEDORA-2014-7896

The remote host is missing an update for the SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[ MDVSA-2014:044 ] zarafa

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2014:044 http://www.mandriva.com/en/support/security/ Package : zarafa Date : February 19, 2014 Affected: Business Server 1.0 Problem Description: Robert Scheck discovered multiple vulnerabilities in Zarafa that...

Zarafa DoS

Few DoS conditions...

CVE-2014-0079

The ValidateUserLogon function in provider/libserver/ECSession.cpp in Zarafa 7.1.8, 6.20.0, and earlier, when using certain build conditions, allows remote attackers to cause a denial of service crash via vectors related to "a NULL pointer of the password."...

CVE-2014-0037

The ValidateUserLogon function in provider/libserver/ECSession.cpp in Zarafa 5.00 before 7.1.8 beta2 allows remote attackers to cause a denial of service crash via vectors related to "a NULL pointer of the username."...

CVE-2014-0079

The ValidateUserLogon function in provider/libserver/ECSession.cpp in Zarafa 7.1.8, 6.20.0, and earlier, when using certain build conditions, allows remote attackers to cause a denial of service crash via vectors related to "a NULL pointer of the password."...

Null pointer dereference

The ValidateUserLogon function in provider/libserver/ECSession.cpp in Zarafa 5.00 before 7.1.8 beta2 allows remote attackers to cause a denial of service crash via vectors related to "a NULL pointer of the username."...

CVE-2014-0037

Zarafa (aka Zarafa Server) is affected by CVE-2014-0037. The vulnerability resides in ValidateUserLogon logic in provider/libserver/ECSession.cpp, allowing a remote attacker to crash the zarafa-server by triggering a NULL pointer issue related to the username. Public disclosures indicate Zarafa 5...

CVE-2014-0079

The CVE-2014-0079 issue affects Zarafa’s ValidateUserLogon path in provider/libserver/ECSession.cpp, enabling remote denial of service (crash) via a NULL password pointer. Affected products/versions identified in sources include Zarafa 7.1.8, 6.20.0 and earlier. Public disclosures and advisories ...

CVE-2014-0079

The ValidateUserLogon function in provider/libserver/ECSession.cpp in Zarafa 7.1.8, 6.20.0, and earlier, when using certain build conditions, allows remote attackers to cause a denial of service crash via vectors related to "a NULL pointer of the password."...

Updated zarafa packages fix security vulnerabilities

Robert Scheck discovered multiple vulnerabilities in Zarafa that could allow a remote unauthenticated attacker to crash the zarafa-server daemon, preventing access to any other legitimate Zarafa users CVE-2014-0037, CVE-2014-0079...

MGASA-2014-0112 Updated zarafa packages fix security vulnerabilities

Robert Scheck discovered multiple vulnerabilities in Zarafa that could allow a remote unauthenticated attacker to crash the zarafa-server daemon, preventing access to any other legitimate Zarafa users CVE-2014-0037, CVE-2014-0079...

Mandriva Linux Security Advisory : zarafa (MDVSA-2014:044)

Robert Scheck discovered multiple vulnerabilities in Zarafa that could allow a remote unauthenticated attacker to crash the zarafa-server daemon, preventing access to any other legitimate Zarafa users CVE-2014-0037, CVE-2014-0079. The updated packages have been upgraded to the 7.1.8 version which...