DEBIAN-CVE-2022-26874

lib/Horde/Mime/Viewer/Ooo.php in Horde Mime_Viewer before 2.2.4 allows XSS via an OpenOffice document, leading to account takeover in Horde Groupware Webmail Edition. This occurs after XSLT rendering.

References

https://security-tracker.debian.org/tracker/CVE-2022-26874

Affected packages

Debian:12 / php-horde-mime-viewer

Package

Name: php-horde-mime-viewer
Purl: pkg:deb/debian/php-horde-mime-viewer?arch=source&distro=bookworm

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

2.2.4+debian0-1

Affected versions

1.*

1.0.8-1

1.0.8-1.1

2.*

2.0.1-1

2.0.1-2

2.0.2-1

2.0.4-1

2.0.5-1

2.0.6-1

2.0.7-1

2.0.7-2

2.1.0-1

2.1.1-1

2.1.1-2

2.1.2-1

2.1.2-2

2.1.3-1

2.1.3-2

2.2.1-1

2.2.2-1

2.2.2-2

2.2.2-3

2.2.2-4

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Database specific

source

"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2022-26874.json"