This update of horde fixes the following vulnerabilities :

  - CVE-2008-1284: directory traversal allows authenticated     user to access and execute arbitrary files

  - CVE-2008-3330: remotely exploitable XSS

  - CVE-2008-3824: remotely exploitable XSS

Upgrade to 3.3.6 - Fixes a lot of security bugs

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Secunia reports :

Some vulnerabilities have been reported in various Horde products, which can be exploited by malicious people to conduct script insertion attacks

Input via MIME attachment linking is not properly sanitised in the MIME library before being used. This can be exploited to execute arbitrary HTML and script code in a user's browser session if e.g. a malicious email is viewed.

Certain unspecified input in HTML messages is not properly sanitised before being used. This can be exploited to execute arbitrary HTML and script in a user's browser session if e.g. a malicious HTML email is viewed.

ID	Name	Product	Family	Published	Updated	Severity
39984	openSUSE Security Update : horde (horde-311)	Nessus	SuSE Local Security Checks	7/21/2009	1/14/2021	medium
34959	openSUSE 10 Security Update : horde (horde-5791)	Nessus	SuSE Local Security Checks	11/25/2008	1/14/2021	medium
47390	Fedora 11 : horde-3.3.6-1.fc11 (2010-5483)	Nessus	Fedora Local Security Checks	7/1/2010	1/11/2021	medium
47395	Fedora 12 : horde-3.3.6-1.fc12 (2010-5520)	Nessus	Fedora Local Security Checks	7/1/2010	1/11/2021	medium
34165	FreeBSD : horde -- multiple vulnerabilities (7d239578-7ff2-11dd-8de5-0030843d3802)	Nessus	FreeBSD Local Security Checks	9/11/2008	1/6/2021	medium
47404	Fedora 13 : horde-3.3.6-1.fc13 (2010-5563)	Nessus	Fedora Local Security Checks	7/1/2010	1/11/2021	medium

Detections

Analytics

Plugins Search

medium

medium

medium

medium

medium

medium