Description
Unspecified vulnerability in Kolab Webclient before 1.2.0 in Kolab Server before 2.2.3 allows attackers to have an unspecified impact via vectors related to an "image upload form."
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 5.0 | horde3 | 3.2.2+debian0-2+lenny1 | DSA-1897-1 |
| Debian 4.0 | horde3 | 3.1.3-4etch6 | DSA-1897-1 |
Advisories 1
- DSA-1897-1 horde3 - arbitrary code execution Debian Security (DSA / DLA) · Mar 9, 2026
References
- http://files.kolab.org/server/release/kolab-server-2.2.3/sources/release-notes.txt
- 37918 third-party-advisory
- MDVSA-2010:108 vendor-advisory
- 61301 vdb-entry
- ADV-2010-1245 vdb-entry
- 37465 vdb-entry