lp:ubuntu/gutsy-security/horde3
- Get this branch:
- bzr branch lp:ubuntu/gutsy-security/horde3
Branch merges
Branch information
Recent revisions
- 11. By Emanuele Gentili
-
* SECURITY UPDATE: (LP: #203456)
+ Directory traversal vulnerability in Horde 3.1.6, Groupware before 1.0.5,
and Groupware Webmail Edition before 1.0.6, when running with certain
configurations, allows remote authenticated users to read and execute arbitrary
files via ".." sequences and a null byte in the theme name.
Fix directory traversal vulnerability in Registry.php which allows
an attacker to read and execute arbitrary local files via crafted
path sequences.* References
+ http://ftp.horde. org/pub/ horde/patches/ patch-horde- 3.1.6-3. 1.7.gz
+ http://www.cve. mitre.org/ cgi-bin/ cvename. cgi?name= 2008-1284
+ http://bugs.debian. org/cgi- bin/bugreport. cgi?bug= 470640
+ http://www.debian. org/security/ 2008/dsa- 1519 - 10. By Gregory Colpart (evolix)
-
* New upstream release.
* Transition to PHP5 for Recommends and Suggests fields. (Closes: #432237)
* Remove old phpapi-* from Depends: (Closes: #420644)
* Clean Depends, Recommends and Suggests fields.
* Remove exec right for XML files in debian/rules.
* Add locales in Recommends.
* Disable upstream _detect_webroot() function (unsable in Debian).
* Fix XSS vulnerability. See CVE-2007-1473 for more information.
(Closes: #434045) - 9. By Ola Lundqvist
-
Changed webroot from /horde to /horde3, especially regarding cookie
handling, closes: #391493. - 8. By Ola Lundqvist
-
Correction for arbitrary file deletion vulnerability,
closes: #415116. Thanks to Paul TBBle Hampson <email address hidden>
for providing the patch. - 7. By Ola Lundqvist
-
Changed the default cookie path from /horde to horde3, closes:
#391493. Thanks for Gregory Colpart <email address hidden> for committing
this change and to Lorenzo Bettini <email address hidden> for
suggesting it. - 6. By Ola Lundqvist
-
* New upstream version, closes: #383416. This is a bugfix release to
correct CVE-2006-4256.
* Now suggests gettext, closes: #385457. - 5. By Ola Lundqvist
-
The SuSE maintainer found several XSS isses in Horde. See
CVE-2006-2195 for more information. Thanks to Moritz Muehlenhoff
<email address hidden> for providing the patch. - 4. By Lionel Elie Mamane <email address hidden>
-
[ Lionel Elie Mamane <email address hidden> ]
* New upstream version
- Close remote arbitrary command execution hole (closes: #360023)
* Really exclude {arch} directory from being installed in binary
package. - 2. By Ola Lundqvist
-
Added conflict on horde so removing horde do not cause configuration
removal in horde3, closes: #307623.
Branch metadata
- Branch format:
- Branch format 7
- Repository format:
- Bazaar repository format 2a (needs bzr 1.16 or later)
- Stacked on:
- lp:ubuntu/karmic/horde3