Bugzilla – Bug 860833
VUL-0: CVE-2014-1691: horde: remote command execution horde < 5.1.1
Last modified: 2015-02-17 17:32:21 UTC
Via OSS-sec: Date: Tue, 28 Jan 2014 10:10:19 +0000 From: Pedro Ribeiro To: oss-security Hi, There is a remote code execution bug in horde affecting all versions from at least horde 3.1.x to 5.1.1. This has been fixed in commit https://github.com/horde/horde/commit/da6afc7e9f4e290f782eca9dbca794f772caccb3 Also check changelog https://github.com/horde/horde/blob/82c400788537cfc0106b68447789ff53793ac086/bundles/groupware/docs/CHANGES# +L215 Can you please assign a CVE for this issue? Thanks in advance. PS: while I discovered this bug independently reviewing horde3 code, the full credit should go to the horde maintainers as they discovered and fixed it first on horde5. Regards Pedro
Nothing to do for 13.1 or factory. We already ship horde5 5.1.2-2.1
Sorry - mixed up with the ISV repo. I'll forward the fixed version.
bugbot adjusting priority
Via RH: Morning, In Fedora there is horde and php-horde-Horde-Util: http://koji.fedoraproject.org/koji/buildinfo?buildID=446660 http://koji.fedoraproject.org/koji/buildinfo?buildID=449705 I am not familiar with Horde or know the difference between those packages, whether one is an older version and the other providing equivalent functionality to version 5. The github commit in the original message is in php-horde-Horde-Util for us. The same vulnerability is in our horde package too, but I could not find this (horde-3.3.13/lib/Horde/Variables.php) in github: 21 class Variables { 22 23 var $_vars; 24 var $_expectedVariables = array(); 25 26 function Variables($vars = array()) 27 { 28 if (is_null($vars)) { 29 $vars = Util::dispelMagicQuotes($_REQUEST); 30 } 31 if (isset($vars['_formvars'])) { 32 $this->_expectedVariables = @unserialize($vars['_formvars']); 33 unset($vars['_formvars']); 34 } 35 $this->_vars = $vars; Mailing here in case anyone else is shipping in a similar way (or if another CVE is needed?). Cheers, -- Murray McAllister / Red Hat Security Response Team
CVE-2014-1691
We have long dropped horde3 (which is in cvs, not git) and only need to update the horde5-related package.
already fixed