Description
Multiple cross-site scripting (XSS) vulnerabilities in Horde before 3.0.7 allow remote attackers to inject arbitrary web script or HTML via the (1) gzip/tar and (2) css MIME viewers, which do not filter or escape dangerous HTML when extracting and displaying attachments.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 3.1 | horde3 | 3.0.4-4sarge2 | DSA-909-1 |
Advisories 1
- DSA-909-1 horde3 - missing input sanitising Debian Security (DSA / DLA) · Mar 9, 2026
References
- GLSA-200511-20 vendor-advisory
- ADV-2005-2536 vdb-entry
- 17599 third-party-advisory
- 20051122 Horde MIME Viewer vulnerability mailing-list
- 15535 vdb-entry
- 17703 third-party-advisory
- [horde-announce] 20051122 Horde 3.0.7 (final) mailing-list
- DSA-909 vendor-advisory