Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Loading...
Explore Latest Linux Security advisories
We found 5 articles for you...
89
security advisoryfedoracriticalFedora 28: 2019-944ff52ce6 Critical Vulnerability in Horde Image
**Horde_Image 2.5.4** * [mjr] SECURITY: Fix potential RCE in the text method when using the Imagemagick backend. * [mjr] SECURITY: Sanitize image type parameter (PR: 2, Fariskhi Vidyan). * [mjr] Fix issues with escaping single and double quote characters in the text method when using the Imagemagick backend.. --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2019-944ff52ce6 2019-01-11 02:58:39.927899 --------------------------------------------------------------------------------Name : php-horde-Horde-Image Product : Fedora 28 Version : 2.5.4 Release : 1.fc28 URL : http://pear.horde.org Summary : Horde Image API Description : An Image utility API, with backends for: * GD * GIF * PNG * SVG * SWF * ImageMagick convert command line tool * Imagick Extension Optional dependency: php-pecl-imagick --------------------------------------------------------------------------------Update Information: **Horde_Image 2.5.4** * [mjr] SECURITY: Fix potential RCE in the text method when using the Imagemagick backend. * [mjr] SECURITY: Sanitize image type parameter (PR: 2, Fariskhi Vidyan). * [mjr] Fix issues with escaping single and double quote characters in the text method when using the Imagemagick backend. --------------------------------------------------------------------------------ChangeLog: * Wed Jan 2 2019 Remi Collet - 2.5.4-1 - update to 2.5.4 - use range dependencies * Mon Jun 25 2018 Remi Collet - 2.5.3-1 - update to 2.5.3 --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2019-944ff52ce6' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project canbe found at https://fedoraproject.org/security/ --------------------------------------------------------------------------------_______________________________________________ package-announce mailing list --
Jan 11, 2019
•Critical
Fedora
89
security advisoryfedorasoftware updateFedora 25: 2017-17f457262c Critical XSS Fix for Horde URL
**Horde_Url 2.2.6** * [jan] SECURITY: Fix XSS vulnerability with pathinfo component in toString().. --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2017-17f457262c 2017-08-10 15:18:03.832346 --------------------------------------------------------------------------------Name : php-horde-Horde-Url Product : Fedora 25 Version : 2.2.6 Release : 1.fc25 URL : http://pear.horde.org Summary : Horde Url class Description : This class represents a single URL and provides methods for manipulating URLs. --------------------------------------------------------------------------------Update Information: **Horde_Url 2.2.6** * [jan] SECURITY: Fix XSS vulnerability with pathinfo component in toString(). --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade php-horde-Horde-Url' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ -------------------------------------------------------------------------------- _______________________________________________ package-announce mailing list --
Aug 10, 2017
•Critical
Fedora
89
security advisorysecurity issueFedoraFedora 26: 2017-1081235137 Critical: Horde 5.2.16 Open Redirect
**horde 5.2.16** * [jan] SECURITY: Fix open redirects.. --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2017-1081235137 2017-08-10 15:18:13.065715 --------------------------------------------------------------------------------Name : php-horde-horde Product : Fedora 26 Version : 5.2.16 Release : 1.fc26 URL : https://www.horde.org/apps/horde Summary : Horde Application Framework Description : The Horde Application Framework is a flexible, modular, general-purpose web application framework written in PHP. It provides an extensive array of components that are targeted at the common problems and tasks involved in developing modern web applications. It is the basis for a large number of production-level web applications, notably the Horde Groupware suites. For more information on Horde or the Horde Groupware suites, visit https://www.horde.org/. --------------------------------------------------------------------------------Update Information: **horde 5.2.16** * [jan] SECURITY: Fix open redirects. --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade php-horde-horde' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ -------------------------------------------------------------------------------- _______________________________________________ package-announce mailing list --
Aug 10, 2017
•Critical
Fedora
89
security advisoryfedoraremote code executionFedora 24: php-horde-Horde-Image Security Update for Command Injection
**Horde_Image 2.5.1** * [mjr] SECURITY: Fix more potential places for command injections. ---- **Horde_Image 2.5.0** * [mjr] **SECURITY**: Prevent DOS attack by preventing an infinite loop in certain conditions (CVE-2017-9773, reported by Fariskhi Vidyan). * [mjr] **SECURITY**: Prevent RCE attacks by properly sanitizing shell arguments (CVE-2017-9774, reported by Fariskhi. --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2017-299525e757 2017-07-11 18:56:33.191186 --------------------------------------------------------------------------------Name : php-horde-Horde-Image Product : Fedora 24 Version : 2.5.1 Release : 1.fc24 URL : http://pear.horde.org Summary : Horde Image API Description : An Image utility API, with backends for: * GD * GIF * PNG * SVG * SWF * ImageMagick convert command line tool * Imagick Extension Optional dependency: php-pecl-imagick --------------------------------------------------------------------------------Update Information: **Horde_Image 2.5.1** * [mjr] SECURITY: Fix more potential places for command injections. ---- **Horde_Image 2.5.0** * [mjr] **SECURITY**: Prevent DOS attack by preventing an infinite loop in certain conditions (CVE-2017-9773, reported by Fariskhi Vidyan). * [mjr] **SECURITY**: Prevent RCE attacks by properly sanitizing shell arguments (CVE-2017-9774, reported by Fariskhi Vidyan). * [jan] Add blur effect. --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade php-horde-Horde-Image' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be foundat https://fedoraproject.org/security/ -------------------------------------------------------------------------------- _______________________________________________ package-announce mailing list --
Jul 12, 2017
•Important
Fedora
87
security advisorycritical issueremote code executionDebian DSA-1897-1 Critical: Horde3 Remote Code Execution Fix
Stefan Esser discovered that Horde, a web application framework providing classes for dealing with preferences, compression, browser detection, connection tracking, MIME, and more, is insufficiently validating and escaping user provided input. The Horde_Form_Type_image form element . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -------------------------------------------------------------------------- Debian Security Advisory DSA-1897-1
Sep 28, 2009
•Critical
Debian
91
security advisorygentoocode executionGentoo: GLSA-200909-14 Normal: Horde Code Execution and XSS Risks
Multiple vulnerabilities have been discovered in Horde and two modules, allowing for the execution of arbitrary code, information disclosure, or Cross-Site Scripting. [More...]. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 200909-14 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Normal Title: Horde: Multiple vulnerabilities Date: September 12, 2009 Bugs: #256125, #262976, #262978, #277294 ID: 200909-14 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======= Multiple vulnerabilities have been discovered in Horde and two modules, allowing for the execution of arbitrary code, information disclosure, or Cross-Site Scripting. Background ========= Horde is a web application framework written in PHP. Horde IMP, the "Internet Messaging Program", is a Webmail module and Horde Passwd is a password changing module for Horde. Affected packages ================ ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 www-apps/horde < 3.3.4 > = 3.3.4 2 www-apps/horde-imp < 4.3.4 > = 4.3.4 3 www-apps/horde-passwd < 3.1.1 > = 3.1.1 ------------------------------------------------------------------- 3 affected packages on all of their supported architectures. ------------------------------------------------------------------- Description ========== Multiple vulnerabilities have been discovered in Horde: * Gunnar Wrobel reported an input sanitation and directory traversal flaw in framework/Image/Image.php, related to the"Horde_Image driver name" (CVE-2009-0932). * Gunnar Wrobel reported that data sent to horde/services/portal/cloud_search.php is not properly sanitized before used in the output (CVE-2009-0931). * It was reported that data sent to framework/Text_Filter/Filter/xss.php is not properly sanitized before used in the output (CVE-2008-5917). Horde Passwd: David Wharton reported that data sent via the "backend" parameter to passwd/main.php is not properly sanitized before used in the output (CVE-2009-2360). Horde IMP: Gunnar Wrobel reported that data sent to smime.php, pgp.php, and message.php is not properly sanitized before used in the output (CVE-2009-0930). Impact ===== A remote authenticated attacker could exploit these vulnerabilities to execute arbitrary PHP files on the server, or disclose the content of arbitrary files, both only if the file is readable to the web server. A remote authenticated attacker could conduct Cross-Site Scripting attacks. NOTE: Some Cross-Site Scripting vectors are limited to the usage of Microsoft Internet Explorer. Workaround ========= There is no known workaround at this time. Resolution ========= All Horde users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose =www-apps/horde-3.3.4 All Horde IMP users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose =www-apps/horde-imp-4.3.4 All Horde Passwd users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose =www-apps/horde-passwd-3.1.1 References ========= [ 1 ] CVE-2008-5917 https://www.cve.org/CVERecord?id=CVE-2008-5917 [ 2 ] CVE-2009-0930 https://www.cve.org/CVERecord?id=CVE-2009-0930 [ 3 ] CVE-2009-0931 https://www.cve.org/CVERecord?id=CVE-2009-0931 [ 4 ] CVE-2009-0932 https://www.cve.org/CVERecord?id=CVE-2009-0932 [ 5 ] CVE-2009-2360 https://www.cve.org/CVERecord?id=CVE-2009-2360 Availability =========== This GLSA and anyupdates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/200909-14 Concerns? ======== Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users machines is of utmost importance to us. Any security concerns should be addressed to
Sep 12, 2009
Gentoo
87
security advisorycritical issuedebianDebian 4.0: DSA-1519-1 Critical: Horde3 Remote File Access Risk
It was discovered that the Horde web application framework permits arbitrary file inclusion by a remote attacker through the theme preference parameter.. - ------------------------------------------------------------------------Debian Security Advisory DSA-1519-1
Mar 15, 2008
•Critical
Debian
87
security advisorycriticaldebianDebian: DSA-1470-1 Critical: Horde Email Deletion DoS Advisory
Ulf Harnhammer discovered that the HTML filter of the Horde web application framework performed insufficient input sanitising, which may lead to the deletion of emails if a user is tricked into viewing a malformed email inside the Imp client.. - ------------------------------------------------------------------------Debian Security Advisory DSA-1470-1
Jan 20, 2008
•Critical
Debian
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!