Test ID:	1.3.6.1.4.1.25623.1.0.67200
Category:	Fedora Local Security Checks
Title:	Fedora Core 13 FEDORA-2010-5563 (horde)
Summary:	NOSUMMARY
Description:	Description: The remote host is missing an update to horde announced via advisory FEDORA-2010-5563. Update Information: Upgrade to 3.3.6 - Fixes a lot of security bugs References: [ 1 ] Bug #549506 - CVE-2009-3701 horde: PHP_SELF XSS vulnerabilities https://bugzilla.redhat.com/show_bug.cgi?id=549506 [ 2 ] Bug #549516 - CVE-2009-4363 horde: XSS vulnerability via data: URIs https://bugzilla.redhat.com/show_bug.cgi?id=549516 [ 3 ] Bug #523401 - CVE-2009-3236 Horde: Improper validation of image form fields (local files overwrite) https://bugzilla.redhat.com/show_bug.cgi?id=523401 [ 4 ] Bug #523407 - CVE-2009-3237 Horde: XSS in number type preferences and in MIME rendering https://bugzilla.redhat.com/show_bug.cgi?id=523407 [ 5 ] Bug #490932 - CVE-2009-0931 CVE-2009-0932 horde: XSS vulnerability and directory traversal vulnerability https://bugzilla.redhat.com/show_bug.cgi?id=490932 [ 6 ] Bug #461886 - CVE-2008-3823 horde: XSS via filename of MIME attachments (oCERT-2008-012) https://bugzilla.redhat.com/show_bug.cgi?id=461886 [ 7 ] Bug #461887 - CVE-2008-3824 horde: XSS via unescaped '/' characters (oCERT-2008-012) https://bugzilla.redhat.com/show_bug.cgi?id=461887 [ 8 ] Bug #480818 - CVE-2008-5917 horde: IE-specific XSS via image style attribute https://bugzilla.redhat.com/show_bug.cgi?id=480818 Solution: Apply the appropriate updates. This update can be installed with the yum update program. Use su -c 'yum update horde' at the command line. For more information, refer to Managing Software with yum, available at http://docs.fedoraproject.org/yum/. http://www.securityspace.com/smysecure/catid.html?in=FEDORA-2010-5563 Risk factor : High CVSS Score: 6.4
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2009-3701 BugTraq ID: 37351 http://www.securityfocus.com/bid/37351 Bugtraq: 20091217 [ISecAuditors Security Advisories] Horde 3.3.5 "PHP_SELF" Cross-Site Scripting vulnerability (Google Search) http://www.securityfocus.com/archive/1/508531/100/0/threaded http://archives.neohapsis.com/archives/fulldisclosure/2009-12/0388.html http://lists.horde.org/archives/announce/2009/000529.html http://marc.info/?l=horde-announce&m=126100750018478&w=2 http://marc.info/?l=horde-announce&m=126101076422179&w=2 http://securitytracker.com/id?1023365 http://secunia.com/advisories/37709 http://secunia.com/advisories/37823 http://www.vupen.com/english/advisories/2009/3549 http://www.vupen.com/english/advisories/2009/3572 XForce ISS Database: horde-admininterface-xss(54817) https://exchange.xforce.ibmcloud.com/vulnerabilities/54817 Common Vulnerability Exposure (CVE) ID: CVE-2009-4363 Common Vulnerability Exposure (CVE) ID: CVE-2009-3236 Debian Security Information: DSA-1897 (Google Search) http://www.debian.org/security/2009/dsa-1897 http://marc.info/?l=horde-announce&m=125292088004087&w=2 http://marc.info/?l=horde-announce&m=125294558611682&w=2 http://marc.info/?l=horde-announce&m=125292314007049&w=2 http://marc.info/?l=horde-announce&m=125295852706029&w=2 http://marc.info/?l=horde-announce&m=125291625030436&w=2 http://marc.info/?l=horde-announce&m=125292339907481&w=2 http://www.osvdb.org/58107 http://secunia.com/advisories/36665 http://secunia.com/advisories/36882 XForce ISS Database: horde-application-form-file-overwrite(53202) https://exchange.xforce.ibmcloud.com/vulnerabilities/53202 Common Vulnerability Exposure (CVE) ID: CVE-2009-3237 http://www.osvdb.org/58108 http://www.osvdb.org/58109 XForce ISS Database: horde-mimeviewer-xss(53200) Common Vulnerability Exposure (CVE) ID: CVE-2009-0931 BugTraq ID: 33491 http://www.securityfocus.com/bid/33491 http://lists.horde.org/archives/announce/2009/000483.html http://lists.horde.org/archives/announce/2009/000482.html http://lists.horde.org/archives/announce/2009/000486.html http://secunia.com/advisories/33695 Common Vulnerability Exposure (CVE) ID: CVE-2009-0932 http://secunia.com/advisories/34418 http://secunia.com/advisories/34609 http://securityreason.com/securityalert/8077 SuSE Security Announcement: SUSE-SR:2009:007 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00004.html Common Vulnerability Exposure (CVE) ID: CVE-2008-3823 20080910 [oCERT-2008-012] Horde, Popoon frameworks common input sanitization errors (XSS) http://www.securityfocus.com/archive/1/496182/100/0/threaded 31110 http://www.securityfocus.com/bid/31110 31842 http://secunia.com/advisories/31842 31959 http://secunia.com/advisories/31959 4245 http://securityreason.com/securityalert/4245 ADV-2008-2548 http://www.vupen.com/english/advisories/2008/2548 DSA-1642 http://www.debian.org/security/2008/dsa-1642 [horde-announce] 20080910 [SECURITY] Horde 3.2.2 (final) http://marc.info/?l=horde-announce&m=122104360019867&w=2 [oss-security] 20080910 [oCERT-2008-012] Horde, Popoon frameworks common input sanitization errors (XSS) http://www.openwall.com/lists/oss-security/2008/09/10/1 horde-mime-xss(45030) https://exchange.xforce.ibmcloud.com/vulnerabilities/45030 http://ocert.org/patches/2008-012/MIME.patch http://www.ocert.org/advisories/ocert-2008-012.html Common Vulnerability Exposure (CVE) ID: CVE-2008-3824 31107 http://www.securityfocus.com/bid/31107 47996 http://osvdb.org/47996 [horde-announce] 20080910 Horde 3.1.9 (final) http://marc.info/?l=horde-announce&m=122103888111491&w=2 horde-htmlmessages-xss(45031) https://exchange.xforce.ibmcloud.com/vulnerabilities/45031 http://blog.liip.ch/missed-case-in-externalinput-php-resulting-in-viable-xss-attacks.html http://ocert.org/patches/2008-012/Text_Filter.31.patch http://ocert.org/patches/2008-012/Text_Filter.patch http://www.phpmyfaq.de/advisory_2008-09-11.php Common Vulnerability Exposure (CVE) ID: CVE-2008-5917 34418 34609 SUSE-SR:2009:007 [announce] Horde 3.2.3 (final) http://lists.horde.org/archives/announce/2008/000462.html [announce] Horde 3.3.1 (final) http://lists.horde.org/archives/announce/2008/000464.html http://cvs.horde.org/diff.php/framework/Text_Filter/Filter/xss.php?r1=1.17&r2=1.18
Copyright	Copyright (c) 2010 E-Soft Inc. http://www.securityspace.com

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.