In Horde_Crypt before 2.7.6, as used in Horde Groupware Webmail Edition 5.x through 5.2.17, OS Command Injection can occur if the user has PGP features enabled in the user's preferences, and has enabled the "Should PGP signed messages be automatically verified when viewed?" preference. To exploit this vulnerability, an attacker can send a PGP signed email (that is maliciously crafted) to the Horde user, who then must either view or preview it.
{
"unresolved_ranges": [
{
"source": "CPE_STRING",
"cpes": [
"cpe:2.3:a:horde:groupware:5.0.0:*:*:*:webmail:*:*:*"
],
"vendor_product": "horde:groupware",
"extracted_events": [
{
"introduced": "5.0.0"
},
{
"last_affected": "5.0.0"
}
]
}
]
}{
"cpe": [
"cpe:2.3:a:horde:groupware:5.0.0:*:*:*:webmail:*:*:*",
"cpe:2.3:a:horde:groupware:5.0.0:rc1:*:*:webmail:*:*:*",
"cpe:2.3:a:horde:groupware:5.0.1:*:*:*:webmail:*:*:*",
"cpe:2.3:a:horde:groupware:5.0.2:*:*:*:webmail:*:*:*",
"cpe:2.3:a:horde:groupware:5.0.3:*:*:*:webmail:*:*:*",
"cpe:2.3:a:horde:groupware:5.0.4:*:*:*:webmail:*:*:*",
"cpe:2.3:a:horde:groupware:5.0.5:*:*:*:webmail:*:*:*",
"cpe:2.3:a:horde:groupware:5.1.0:*:*:*:webmail:*:*:*",
"cpe:2.3:a:horde:groupware:5.1.0:rc1:*:*:webmail:*:*:*",
"cpe:2.3:a:horde:groupware:5.1.1:*:*:*:webmail:*:*:*",
"cpe:2.3:a:horde:groupware:5.1.2:*:*:*:webmail:*:*:*",
"cpe:2.3:a:horde:groupware:5.1.3:*:*:*:webmail:*:*:*",
"cpe:2.3:a:horde:groupware:5.1.4:*:*:*:webmail:*:*:*",
"cpe:2.3:a:horde:groupware:5.1.5:*:*:*:webmail:*:*:*",
"cpe:2.3:a:horde:groupware:5.2.0:*:*:*:webmail:*:*:*",
"cpe:2.3:a:horde:groupware:5.2.0:rc1:*:*:webmail:*:*:*",
"cpe:2.3:a:horde:groupware:5.2.1:*:*:*:webmail:*:*:*",
"cpe:2.3:a:horde:groupware:5.2.2:*:*:*:webmail:*:*:*",
"cpe:2.3:a:horde:groupware:5.2.3:*:*:*:webmail:*:*:*",
"cpe:2.3:a:horde:groupware:5.2.4:*:*:*:webmail:*:*:*",
"cpe:2.3:a:horde:groupware:5.2.5:*:*:*:webmail:*:*:*",
"cpe:2.3:a:horde:groupware:5.2.6:*:*:*:webmail:*:*:*",
"cpe:2.3:a:horde:groupware:5.2.7:*:*:*:webmail:*:*:*"
],
"source": "CPE_STRING",
"extracted_events": [
{
"introduced": "5.0.0"
},
{
"last_affected": "5.0.0"
},
{
"introduced": "5.0.0-rc1"
},
{
"last_affected": "5.0.0-rc1"
},
{
"introduced": "5.0.1"
},
{
"last_affected": "5.0.1"
},
{
"introduced": "5.0.2"
},
{
"last_affected": "5.0.2"
},
{
"introduced": "5.0.3"
},
{
"last_affected": "5.0.3"
},
{
"introduced": "5.0.4"
},
{
"last_affected": "5.0.4"
},
{
"introduced": "5.0.5"
},
{
"last_affected": "5.0.5"
},
{
"introduced": "5.1.0"
},
{
"last_affected": "5.1.0"
},
{
"introduced": "5.1.0-rc1"
},
{
"last_affected": "5.1.0-rc1"
},
{
"introduced": "5.1.1"
},
{
"last_affected": "5.1.1"
},
{
"introduced": "5.1.2"
},
{
"last_affected": "5.1.2"
},
{
"introduced": "5.1.3"
},
{
"last_affected": "5.1.3"
},
{
"introduced": "5.1.4"
},
{
"last_affected": "5.1.4"
},
{
"introduced": "5.1.5"
},
{
"last_affected": "5.1.5"
},
{
"introduced": "5.2.0"
},
{
"last_affected": "5.2.0"
},
{
"introduced": "5.2.0-rc1"
},
{
"last_affected": "5.2.0-rc1"
},
{
"introduced": "5.2.1"
},
{
"last_affected": "5.2.1"
},
{
"introduced": "5.2.2"
},
{
"last_affected": "5.2.2"
},
{
"introduced": "5.2.3"
},
{
"last_affected": "5.2.3"
},
{
"introduced": "5.2.4"
},
{
"last_affected": "5.2.4"
},
{
"introduced": "5.2.5"
},
{
"last_affected": "5.2.5"
},
{
"introduced": "5.2.6"
},
{
"last_affected": "5.2.6"
},
{
"introduced": "5.2.7"
},
{
"last_affected": "5.2.7"
}
]
}{
"cpe": [
"cpe:2.3:a:horde:groupware:5.0.0:*:*:*:webmail:*:*:*",
"cpe:2.3:a:horde:groupware:5.0.0:rc1:*:*:webmail:*:*:*",
"cpe:2.3:a:horde:groupware:5.0.1:*:*:*:webmail:*:*:*",
"cpe:2.3:a:horde:groupware:5.0.2:*:*:*:webmail:*:*:*",
"cpe:2.3:a:horde:groupware:5.0.3:*:*:*:webmail:*:*:*",
"cpe:2.3:a:horde:groupware:5.0.4:*:*:*:webmail:*:*:*",
"cpe:2.3:a:horde:groupware:5.0.5:*:*:*:webmail:*:*:*",
"cpe:2.3:a:horde:groupware:5.1.0:*:*:*:webmail:*:*:*",
"cpe:2.3:a:horde:groupware:5.1.0:rc1:*:*:webmail:*:*:*",
"cpe:2.3:a:horde:groupware:5.1.1:*:*:*:webmail:*:*:*",
"cpe:2.3:a:horde:groupware:5.1.2:*:*:*:webmail:*:*:*",
"cpe:2.3:a:horde:groupware:5.1.3:*:*:*:webmail:*:*:*",
"cpe:2.3:a:horde:groupware:5.1.4:*:*:*:webmail:*:*:*",
"cpe:2.3:a:horde:groupware:5.1.5:*:*:*:webmail:*:*:*",
"cpe:2.3:a:horde:groupware:5.2.0:*:*:*:webmail:*:*:*",
"cpe:2.3:a:horde:groupware:5.2.0:rc1:*:*:webmail:*:*:*",
"cpe:2.3:a:horde:groupware:5.2.1:*:*:*:webmail:*:*:*",
"cpe:2.3:a:horde:groupware:5.2.2:*:*:*:webmail:*:*:*",
"cpe:2.3:a:horde:groupware:5.2.3:*:*:*:webmail:*:*:*",
"cpe:2.3:a:horde:groupware:5.2.4:*:*:*:webmail:*:*:*",
"cpe:2.3:a:horde:groupware:5.2.5:*:*:*:webmail:*:*:*",
"cpe:2.3:a:horde:groupware:5.2.6:*:*:*:webmail:*:*:*",
"cpe:2.3:a:horde:groupware:5.2.7:*:*:*:webmail:*:*:*"
],
"extracted_events": [
{
"introduced": "5.0.0"
},
{
"last_affected": "5.0.0"
},
{
"introduced": "5.0.0-rc1"
},
{
"last_affected": "5.0.0-rc1"
},
{
"introduced": "5.0.1"
},
{
"last_affected": "5.0.1"
},
{
"introduced": "5.0.2"
},
{
"last_affected": "5.0.2"
},
{
"introduced": "5.0.3"
},
{
"last_affected": "5.0.3"
},
{
"introduced": "5.0.4"
},
{
"last_affected": "5.0.4"
},
{
"introduced": "5.0.5"
},
{
"last_affected": "5.0.5"
},
{
"introduced": "5.1.0"
},
{
"last_affected": "5.1.0"
},
{
"introduced": "5.1.0-rc1"
},
{
"last_affected": "5.1.0-rc1"
},
{
"introduced": "5.1.1"
},
{
"last_affected": "5.1.1"
},
{
"introduced": "5.1.2"
},
{
"last_affected": "5.1.2"
},
{
"introduced": "5.1.3"
},
{
"last_affected": "5.1.3"
},
{
"introduced": "5.1.4"
},
{
"last_affected": "5.1.4"
},
{
"introduced": "5.1.5"
},
{
"last_affected": "5.1.5"
},
{
"introduced": "5.2.0"
},
{
"last_affected": "5.2.0"
},
{
"introduced": "5.2.0-rc1"
},
{
"last_affected": "5.2.0-rc1"
},
{
"introduced": "5.2.1"
},
{
"last_affected": "5.2.1"
},
{
"introduced": "5.2.2"
},
{
"last_affected": "5.2.2"
},
{
"introduced": "5.2.3"
},
{
"last_affected": "5.2.3"
},
{
"introduced": "5.2.4"
},
{
"last_affected": "5.2.4"
},
{
"introduced": "5.2.5"
},
{
"last_affected": "5.2.5"
},
{
"introduced": "5.2.6"
},
{
"last_affected": "5.2.6"
},
{
"introduced": "5.2.7"
},
{
"last_affected": "5.2.7"
}
],
"source": "CPE_STRING"
}