php-horde-core: CVE-2015-8807: XSS in Horde_Core_VarRenderer_Html

Debian Bug report logs - #813590
php-horde-core: CVE-2015-8807: XSS in Horde_Core_VarRenderer_Html

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Mathieu Parent <math.parent@gmail.com>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: [php-horde-core] XSS in Horde_Core_VarRenderer_Html

Date: Wed, 3 Feb 2016 14:17:40 +0100

Package: php-horde-core
Version: 2.22.5+debian0-1

Will post more info later.

-- 
Mathieu

Message #10 received at 813590-done@bugs.debian.org (full text, mbox, reply):

From: Mathieu Parent <math.parent@gmail.com>

To: 813590-done@bugs.debian.org

Subject: More info

Date: Wed, 3 Feb 2016 14:26:39 +0100

Version: 2.22.4+debian0-1
Control: found -1 2.15.0+debian0-1
Control: tag -1 + security upstream fixed-upstream patch jessie
Control: forwarded -1
https://github.com/horde/horde/commit/11d74fa5a22fe626c5e5a010b703cd46a136f253

I need to fixit for jessie too.

Cheers

-- 
Mathieu

Message #23 received at 813590@bugs.debian.org (full text, mbox, reply):

From: Mathieu Parent <math.parent@gmail.com>

To: 813590@bugs.debian.org

Subject: Jessie debdiff

Date: Thu, 4 Feb 2016 14:18:00 +0100

[Message part 1 (text/plain, inline)]

Here is the patch for jessie.

-- 
Mathieu

[0001-Escape-form-value-fix-XSS-in-Horde_Core_VarRenderer_.patch (text/x-diff, attachment)]

Message #30 received at 813590@bugs.debian.org (full text, mbox, reply):

From: Mathieu Parent <math.parent@gmail.com>

To: 813573@bugs.debian.org, 813590@bugs.debian.org, 813406@bugs.debian.org

Subject: WIP (was: Fwd: Proposed changes to jessie)

Date: Wed, 24 Feb 2016 22:40:21 +0100

Hello,

I've proposed the changes to -security, without response yet.

See below.

---------- Forwarded message ----------
From: Mathieu Parent <math.parent@gmail.com>
Date: 2016-02-24 22:24 GMT+01:00
Subject: Re: Proposed changes to jessie
To: team@security.debian.org


2016-02-04 15:04 GMT+01:00 Mathieu Parent <math.parent@gmail.com>:
> Hello,

Pinging again.

> I have prepared security fixes for two Horde packages:
> - php-horde: https://bugs.debian.org/813573#26 XSS vulnerability in menu bar
Debdiff at: http://anonscm.debian.org/cgit/pkg-horde/PEAR/php-horde.git/diff/?id2=47c6d6e6ad0836d657eee75e36ef8dbd19c843d2&id=112b45b0403df87828e6cd620eb0e3d4fc3c7fa9

> - php-horde-core: https://bugs.debian.org/813590#23 XSS in
> Horde_Core_VarRenderer_Html
Debdiff at: http://anonscm.debian.org/cgit/pkg-horde/PEAR/php-horde-core.git/diff/?id2=d79e0d5424ba76351cde56701e061f91d241ec09&id=a98c8cb02edaaa0378771a7f21855aaafc883785

>
> Can I upload the two packages (this is already fixed in sid)?

Waiting for your answer.

> I have also prepared a ctdb regression update, which fix CTDB behavior
> under Linux after the fix for CVE-2015-8543:
> - https://bugs.debian.org/813406#25 ctdb, raw sockets and CVE-2015-8543

See http://anonscm.debian.org/cgit/pkg-samba/ctdb.git/commit/?h=debian-jessie&id=ec4e506686578cdf13b36ce18ec98cc5307b4e64

> Can I upload it?

Same.

> Can I make the same to wheezy once jessie is uploaded?

Same.

I think keeping those issues in place is not good.

Regards
--
Mathieu Parent

Message #35 received at 813590-close@bugs.debian.org (full text, mbox, reply):

From: Mathieu Parent <sathieu@debian.org>

To: 813590-close@bugs.debian.org

Subject: Bug#813590: fixed in php-horde-core 2.15.0+debian0-1+deb8u1

Date: Sat, 05 Mar 2016 22:33:57 +0000

Source: php-horde-core
Source-Version: 2.15.0+debian0-1+deb8u1

We believe that the bug you reported is fixed in the latest version of
php-horde-core, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 813590@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Mathieu Parent <sathieu@debian.org> (supplier of updated php-horde-core package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Format: 1.8
Date: Fri, 26 Feb 2016 13:18:06 +0100
Source: php-horde-core
Binary: php-horde-core
Architecture: source all
Version: 2.15.0+debian0-1+deb8u1
Distribution: jessie-security
Urgency: high
Maintainer: Horde Maintainers <pkg-horde-hackers@lists.alioth.debian.org>
Changed-By: Mathieu Parent <sathieu@debian.org>
Description:
 php-horde-core - ${phppear:summary}
Closes: 813590
Changes:
 php-horde-core (2.15.0+debian0-1+deb8u1) jessie-security; urgency=high
 .
   * CVE-2015-8807: Escape form value, fix XSS in Horde_Core_VarRenderer_Html
     (Closes: #813590)
Checksums-Sha1:
 c277689cf941ce3ab35ffd2b93b5a07f5decca28 2130 php-horde-core_2.15.0+debian0-1+deb8u1.dsc
 074bb53e43905470410190561c2f8c4caaf86876 1277417 php-horde-core_2.15.0+debian0.orig.tar.gz
 5eafb1333b0f6717e9df58e5fe33354594aa846a 4988 php-horde-core_2.15.0+debian0-1+deb8u1.debian.tar.xz
 99dc6e20adef1f73eb61bc22902e22c6b1d86996 923778 php-horde-core_2.15.0+debian0-1+deb8u1_all.deb
Checksums-Sha256:
 9ba62ea565d9a02b303e36ca1178d97eec7338223ae255a56c7df984c5efaff2 2130 php-horde-core_2.15.0+debian0-1+deb8u1.dsc
 5aa660783113b39bc86ea60a45b80cb891fc26ff916e035d2825ee928afb3f7c 1277417 php-horde-core_2.15.0+debian0.orig.tar.gz
 1d4f569a5b9244bc204cbda05d0818d262633f4dd4895b319d6372527a5d22a0 4988 php-horde-core_2.15.0+debian0-1+deb8u1.debian.tar.xz
 e6a1b3686bc05357a3dc6ef03e9dbca410877a0f07e1f7bc4d9673915f97db0f 923778 php-horde-core_2.15.0+debian0-1+deb8u1_all.deb
Files:
 3e6e4ed29bd822ca4c6b4b688ea97db7 2130 php extra php-horde-core_2.15.0+debian0-1+deb8u1.dsc
 138b8b054989f34e0d7021759524bd7c 1277417 php extra php-horde-core_2.15.0+debian0.orig.tar.gz
 f5fdafdbe8bb5e43dd8c07f6c6f4f4a3 4988 php extra php-horde-core_2.15.0+debian0-1+deb8u1.debian.tar.xz
 3e417c67309cbc8c12869e06ab55187c 923778 php extra php-horde-core_2.15.0+debian0-1+deb8u1_all.deb

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBCAAGBQJW0L7OAAoJEK4DmARmaB+lxB0P/RDc1Gxe9afT+ramTFEyLzqm
za5bqEcZ+Ih45tmNteOIHoc/cEHTPAo+Fpp2eGTY27YtwU6VRS2YyYR/RiNGgCMd
hsDGi/ZwdbJBrPyRGI/0MMKTOpSYPMaa1gAqf8DHXvCL3HDJkucuLdS3pxz7cR0s
CV+M2f62Za3hNuOZ/G7ln/N4IB3gf13w7fYymTYhigS2ShUaQLh9s8puze09eqk1
ce28w1GKPl7ikqgVhAodgykc0TfUZV1BqebBcCN6Ss7WRUSz6N4xvPwCnrChikkg
SFs3TU7B6NiJu+5uGwuPhyc1RDJJ/h0RpDY/RhGHdIUQrShvilRUW09sSDkvN3gF
aigdMRkBm3ofcZf6BaoHpkKVf+9AVuJMZRPoIRqdAlDW9jEeTpiutyiybTvenFuk
wJs+PABhQOo+qRKq/P20DU04MSli8QZsieQeUD0vmceRMtZutb99ZylNfQGFmmio
xgR5gX56V7W8ozcxXmvY0ANNoKzfs6LzV7Iq5/RXB7FXDeeS3Gcp5qKSYGOaDFNu
cJkfz7UiyLId661ukbfV2o2Uml9fcEEPKFtuw62TTTtblSjMELGx19SNHhWhsMZY
E5Voj+Je1kTbUlcoTeX1j7AkPNWauojLmzBpyOM0VkSwG3FfmX3UhafKyXt0AHrV
87Mjl2uTYNifWmqdJyzY
=9Ey2
-----END PGP SIGNATURE-----

Message #36 received at 813590-done@bugs.debian.org (full text, mbox, reply):

From: lawrance massan <lawrancemssswkk@gmail.com>

To: undisclosed-recipients:;

Subject: Attention Please.

Date: Sat, 12 Mar 2016 07:30:04 +0000

[Message part 1 (text/plain, inline)]

[image: Inline image 1]

[Message part 2 (text/html, inline)]

[image.png (image/png, inline)]

[Dear Friend Attention Please..jpg (image/jpeg, attachment)]

Send a report that this bug log contains spam.