lp:ubuntu/edgy-security/horde3

Branch merges

Propose for merging

No branches dependent on this one.

Related source package recipes

No recipes using this branch. (?)

Create packaging recipe

Related snap packages

Related bugs

Related blueprints

7. By Emanuele Gentili on 2008-03-27

* SECURITY UPDATE: (LP: #203456)
 + Directory traversal vulnerability in Horde 3.1.6, Groupware before 1.0.5,
   and Groupware Webmail Edition before 1.0.6, when running with certain
   configurations, allows remote authenticated users to read and execute arbitrary
   files via ".." sequences and a null byte in the theme name.
   Fix directory traversal vulnerability in Registry.php which allows
   an attacker to read and execute arbitrary local files via crafted
   path sequences.

* References
 + http://ftp.horde.org/pub/horde/patches/patch-horde-3.1.6-3.1.7.gz
 + http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=2008-1284
 + http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=470640
 + http://www.debian.org/security/2008/dsa-1519

6. By Ola Lundqvist on 2006-09-03

* New upstream version, closes: #383416. This is a bugfix release to
  correct CVE-2006-4256.
* Now suggests gettext, closes: #385457.

5. By Ola Lundqvist on 2006-06-14

The SuSE maintainer found several XSS isses in Horde. See
CVE-2006-2195 for more information. Thanks to Moritz Muehlenhoff
<email address hidden> for providing the patch.

4. By Lionel Elie Mamane <email address hidden> on 2006-04-06

[ Lionel Elie Mamane <email address hidden> ]
* New upstream version
  - Close remote arbitrary command execution hole (closes: #360023)
* Really exclude {arch} directory from being installed in binary
  package.

3. By Ola Lundqvist on 2005-12-16

Correct fix for weatherdotcom.

2. By Ola Lundqvist on 2005-05-04

Added conflict on horde so removing horde do not cause configuration
removal in horde3, closes: #307623.

1. By Ola Lundqvist on 2005-05-04

Import upstream version 3.0.4