[pkg-horde] Re: horde problem.

[Martin Schulze]

Lionel Elie Mamane wrote:
> On Wed, Mar 29, 2006 at 05:04:27PM +0200, Martin Schulze wrote:
> 
> > I've been told (haven't had the time to check on my own) that a very
> > serious security problem in horde has been discovered.
> 
> > Are you able to provide fixed packages for woody, sarge and sid
> > soon, if the version in one of these distributions is affected
> > by this problem?
> 
> Update for sarge is at http://people.debian.org/horde/ . Review
> recommended and appreciated. Summary of issues and changes:

see below

>  - Remote code execution in help browser (eval() of user-provided
>    data). CVE to be allocated. My packages use "CVE-UNKNOWN-TODO" as a
>    placeholder. (from 3.0.10)

This has been assigned CVE-2006-1491.

The official patch seems to be
http://cvs.horde.org/diff.php?f=horde%2Fservices%2Fhelp%2Findex.php&r1=2.85&r2=2.86

horde2 has lost some of its locale information:

Checking horde2_2.2.8-1sarge2_all.deb against stable
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Files in first .deb but not in second
-------------------------------------
/usr/share/horde2/locale/ar_SY/LC_MESSAGES/horde.mo
/usr/share/horde2/locale/bg_BG/LC_MESSAGES/horde.mo
/usr/share/horde2/locale/ca_ES/LC_MESSAGES/horde.mo
/usr/share/horde2/locale/cs_CZ/LC_MESSAGES/horde.mo
/usr/share/horde2/locale/da_DK/LC_MESSAGES/horde.mo
/usr/share/horde2/locale/de_DE/LC_MESSAGES/horde.mo
/usr/share/horde2/locale/el_GR/LC_MESSAGES/horde.mo
/usr/share/horde2/locale/es_ES/LC_MESSAGES/horde.mo
/usr/share/horde2/locale/et_EE/LC_MESSAGES/horde.mo
/usr/share/horde2/locale/fi_FI/LC_MESSAGES/horde.mo
/usr/share/horde2/locale/fr_FR/LC_MESSAGES/horde.mo
/usr/share/horde2/locale/gl_ES/LC_MESSAGES/horde.mo
/usr/share/horde2/locale/hu_HU/LC_MESSAGES/horde.mo
/usr/share/horde2/locale/id_ID/LC_MESSAGES/horde.mo
/usr/share/horde2/locale/it_IT/LC_MESSAGES/horde.mo
/usr/share/horde2/locale/ja_JP/LC_MESSAGES/horde.mo
/usr/share/horde2/locale/ko_KR/LC_MESSAGES/horde.mo
/usr/share/horde2/locale/lt_LT/LC_MESSAGES/horde.mo
/usr/share/horde2/locale/lv_LV/LC_MESSAGES/horde.mo
/usr/share/horde2/locale/mk_MK/LC_MESSAGES/horde.mo
/usr/share/horde2/locale/nb_NO/LC_MESSAGES/horde.mo
/usr/share/horde2/locale/nl_NL/LC_MESSAGES/horde.mo
/usr/share/horde2/locale/nn_NO/LC_MESSAGES/horde.mo
/usr/share/horde2/locale/pl_PL/LC_MESSAGES/horde.mo
/usr/share/horde2/locale/pt_BR/LC_MESSAGES/horde.mo
/usr/share/horde2/locale/pt_PT/LC_MESSAGES/horde.mo
/usr/share/horde2/locale/ro_RO/LC_MESSAGES/horde.mo
/usr/share/horde2/locale/ru_RU.KOI8-R/LC_MESSAGES/horde.mo
/usr/share/horde2/locale/ru_RU/LC_MESSAGES/horde.mo
/usr/share/horde2/locale/sk_SK/LC_MESSAGES/horde.mo
/usr/share/horde2/locale/sl_SI/LC_MESSAGES/horde.mo
/usr/share/horde2/locale/sv_SE/LC_MESSAGES/horde.mo
/usr/share/horde2/locale/uk_UA/LC_MESSAGES/horde.mo
/usr/share/horde2/locale/zh_CN/LC_MESSAGES/horde.mo
/usr/share/horde2/locale/zh_TW/LC_MESSAGES/horde.mo

Regards,

	Joey

-- 
Life is a lot easier when you have someone to share it with.  -- Sean Perry

Please always Cc to me when replying to me on the lists.