DSA-1470 horde3 -- missing input sanitisingID: oval:org.mitre.oval:def:8124 | Date: (C)2009-12-15 (M)2021-09-11 |
Class: PATCH | Family: unix |
Ulf Hauml rnhammar discovered that the HTML filter of the Horde web application framework performed insufficient input sanitising, which may lead to the deletion of emails if a user is tricked into viewing a malformed email inside the Imp client. This update also provides backported bugfixes to the cross-site scripting filter and the user management API from the latest Horde release 3.1.6. The old stable distribution (sarge) is not affected. An update to Etch is recommended, though.