Candidate: CVE-2015-8807
PublicDate: 2016-04-13 16:59:00 UTC
References:
 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8807
 https://github.com/horde/horde/commit/11d74fa5a22fe626c5e5a010b703cd46a136f253
 http://www.openwall.com/lists/oss-security/2016/02/06/4
Description:
 Cross-site scripting (XSS) vulnerability in the _renderVarInput_number
 function in horde/framework/Core/lib/Horde/Core/Ui/VarRenderer/Html.php in
 Horde Groupware before 5.2.12 and Horde Groupware Webmail Edition before
 5.2.12 allows remote attackers to inject arbitrary web script or HTML via
 vectors involving numeric form fields.
Ubuntu-Description:
 It was discovered that Horde improperly handled certain crafted input. An
 attacker could use this issue to execute a cross-site scripting (XSS) attack.
Notes:
Bugs:
 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=813590
Priority: medium
Discovered-by:
Assigned-to:
CVSS:
 nvd: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N [6.1 MEDIUM]

Patches_php-horde-core:
 upstream: https://github.com/horde/horde/commit/11d74fa5a22fe626c5e5a010b703cd46a136f253
upstream_php-horde-core: released (2.22.4+debian0-1)
precise_php-horde-core: DNE
precise/esm_php-horde-core: DNE
trusty_php-horde-core: ignored (reached end-of-life)
trusty/esm_php-horde-core: DNE (trusty was needed)
vivid/stable-phone-overlay_php-horde-core: DNE
vivid/ubuntu-core_php-horde-core: DNE
wily_php-horde-core: ignored (reached end-of-life)
xenial_php-horde-core: not-affected (2.22.5+debian0-1)
yakkety_php-horde-core: not-affected (2.22.5+debian0-1)
zesty_php-horde-core: not-affected (2.22.5+debian0-1)
artful_php-horde-core: not-affected (2.22.5+debian0-1)
bionic_php-horde-core: not-affected (2.22.5+debian0-1)
cosmic_php-horde-core: not-affected (2.22.5+debian0-1)
disco_php-horde-core: not-affected (2.22.5+debian0-1)
devel_php-horde-core: not-affected (2.22.5+debian0-1)