CVE-2015-3436

Zarafa Collaboration Platform (ZCP) is affected by CVE-2015-3436 due to a symlink attack on /tmp/zarafa-upgrade-lock in provider/server/ECServer.cpp. Affects ZCP before 7.1.13 and 7.2.x before 7.2.1, enabling local users to write arbitrary files. Remediation per sources: upgrade to 7.1.13 or 7.2....

CVE-2014-9465

CVE-2014-9465 affects Zarafa WebApp (before 2.0 beta 3) and Zarafa WebAccess in Zarafa Collaboration Platform (ZCP) 7.x (before 7.1.12 beta 1 and 7.2.x before 7.2.0 beta 1). The issue allows remote attackers to cause a denial of service by uploading a large number of files, leading to /tmp disk c...

CVE-2015-6566

Zarafa Autorespond in Zarafa Collaboration Platform (ZCP) before 7.2.1 is vulnerable to a local privilege escalation via a symlink attack on /tmp/zarafa-vacation-*. The issue affects the zarafa-autorespond component and can allow a local attacker to gain privileges. The CVE-2015-6566 entry identi...

CVE-2014-5450

CVE-2014-5450 concerns Zarafa Collaboration Platform 4.1, where /etc/zarafa/license was created with world-readable permissions, enabling local users to read license files and disclose sensitive information. Public sources in connected documents indicate this issue stems from incorrect default pe...