Nahuel Grisolia discovered two vulnerabilities in Egroupware, a web-based groupware suite: Missing input sanitising in the spellchecker integration may lead to the execution of arbitrary commands and a cross-site scripting vulnerability was discovered in the login page. . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------ Debian Security Advisory DSA-2013-1
Updated package.. - --------------------------------------------------------------------------Debian Security Advisory DSA 899-1
Updated package.. - --------------------------------------------------------------------------Debian Security Advisory DSA 842-1
TikiWiki and eGroupWare both include PHP XML-RPC code vulnerable to arbitrary command execution.. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 200508-14 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: High Title: TikiWiki, eGroupWare: Arbitrary command execution through XML-RPC Date: August 24, 2005 Bugs: #102374, #102377 ID: 200508-14 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======= TikiWiki and eGroupWare both include PHP XML-RPC code vulnerable to arbitrary command execution. Background ========= TikiWiki is a full featured Free Software Wiki, CMS and Groupware written in PHP. eGroupWare is a web-based collaboration software suite. Both TikiWiki and eGroupWare include a PHP library to handle XML-RPC requests. Affected packages ================ ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 www-apps/tikiwiki < 1.8.5-r2 > = 1.8.5-r2 2 www-apps/egroupware < 1.0.0.009 > = 1.0.0.009 ------------------------------------------------------------------- 2 affected packages on all of their supported architectures. ------------------------------------------------------------------- Description ========== The XML-RPC library shipped in TikiWiki and eGroupWare improperly handles XML-RPC requests and responses with malformed nested tags. Impact ===== A remote attacker could exploit this vulnerability to inject arbitrary PHP script code into eval() statements by sending a specially crafted XML document to TikiWiki oreGroupWare. Workaround ========= There is no known workaround at this time. Resolution ========= All TikiWiki users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose "> =www-apps/tikiwiki-1.8.5-r2" All eGroupWare users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose "> =www-apps/egroupware-1.0.0.009" References ========= [ 1 ] CAN-2005-2498 https://www.cve.org/CVERecord?id=CAN-2005-2498 Availability =========== This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/200508-14 Concerns? ======== Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users machines is of utmost importance to us. Any security concerns should be addressed to
A vulnerability has been identified in the xmlrpc library included in the egroupware package. This vulnerability could lead to the execution of arbitrary commands on the server running egroupware.. - ------------------------------------------------------------------------Debian Security Advisory DSA 747-1
Get the latest Linux and open source security news straight to your inbox.