June 2006

ID: 00455
Ref: 442/2006
Date: 30 June 2006:13:47:39
Version: 1

---

Title: Three Gentoo Linux Security Advisories: 1. GLSA 200606-27 - Mutt: Buffer overflow 2. GLSA 200606-28 - Horde Web Application Framework: XSS vulnerability 3. GLSA 200606-29 - Tikiwiki: SQL injection and multiple XSS vulnerabilities
Abstract:
Vendors affected: Gentoo
Operating systems affected: Gentoo
Applications affected: Gentoo

---

Title
=====

Three Gentoo Linux Security Advisories:

1. GLSA 200606-27 - Mutt: Buffer overflow

2. GLSA 200606-28 - Horde Web Application Framework: XSS vulnerability

3. GLSA 200606-29 - Tikiwiki: SQL injection and multiple XSS vulnerabilities

Detail
======

1. TAKAHASHI Tamotsu has discovered that Mutt contains a boundary error in
the "browse_get_namespace()" function in browse.c, which can be
triggered when receiving an overly long namespace from an IMAP server.

2. Michael Marek discovered that the Horde Web Application Framework
performs insufficient input sanitizing.

3. Tikiwiki fails to properly sanitize user input before processing it,
including in SQL statements.




1.



- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 200606-27
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Severity: Normal
Title: Mutt: Buffer overflow
Date: June 28, 2006
Bugs: #138125
ID: 200606-27

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis
========

Mutt contains a buffer overflow that could result in arbitrary code
execution.

Background
==========

Mutt is a small but very powerful text-based mail client.

Affected packages
=================

-------------------------------------------------------------------
Package / Vulnerable / Unaffected
-------------------------------------------------------------------
1 mail-client/mutt < 1.5.11-r2 >= 1.5.11-r2

Description
===========

TAKAHASHI Tamotsu has discovered that Mutt contains a boundary error in
the "browse_get_namespace()" function in browse.c, which can be
triggered when receiving an overly long namespace from an IMAP server.

Impact
======

A malicious IMAP server can send an overly long namespace to Mutt in
order to crash the application, and possibly execute arbitrary code
with the permissions of the user running Mutt.

Workaround
==========

There is no known workaround at this time.

Resolution
==========

All Mutt users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=mail-client/mutt-1.5.11-r2"

References
==========

[ 1 ] CVE-2006-3242
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3242

Availability
============

This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:

http://security.gentoo.org/glsa/glsa-200606-27.xml

Concerns?
=========

Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or alternatively, you may file a bug at
http://bugs.gentoo.org.

License
=======

Copyright 2006 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).

The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.

http://creativecommons.org/licenses/by-sa/2.5




2.



- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 200606-28
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Severity: Low
Title: Horde Web Application Framework: XSS vulnerability
Date: June 29, 2006
Bugs: #136830
ID: 200606-28

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis
========

The Horde Web Application Framework is vulnerable to a cross-site
scripting vulnerability.

Background
==========

The Horde Web Application Framework is a general-purpose web
application framework written in PHP, providing classes for handling
preferences, compression, browser detection, connection tracking, MIME,
and more.

Affected packages
=================

-------------------------------------------------------------------
Package / Vulnerable / Unaffected
-------------------------------------------------------------------
1 www-apps/horde < 3.1.1-r1 >= 3.1.1-r1

Description
===========

Michael Marek discovered that the Horde Web Application Framework
performs insufficient input sanitizing.

Impact
======

An attacker could exploit these vulnerabilities to execute arbitrary
scripts running in the context of the victim's browser.

Workaround
==========

There is no known workaround at this time.

Resolution
==========

All horde users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=www-apps/horde-3.1.1-r1"

References
==========

[ 1 ] CVE-2006-2195
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2195

Availability
============

This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:

http://security.gentoo.org/glsa/glsa-200606-28.xml

Concerns?
=========

Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or alternatively, you may file a bug at
http://bugs.gentoo.org.

License
=======

Copyright 2006 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).

The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.

http://creativecommons.org/licenses/by-sa/2.5


3.



- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 200606-29
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Severity: Normal
Title: Tikiwiki: SQL injection and multiple XSS vulnerabilities
Date: June 29, 2006
Bugs: #136723, #134483
ID: 200606-29

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis
========

An SQL injection vulnerability and multiple XSS vulnerabilities have
been discovered.

Background
==========

Tikiwiki is a web-based groupware and content management system (CMS),
using PHP, ADOdb and Smarty.

Affected packages
=================

-------------------------------------------------------------------
Package / Vulnerable / Unaffected
-------------------------------------------------------------------
1 www-apps/tikiwiki < 1.9.4 >= 1.9.4

Description
===========

Tikiwiki fails to properly sanitize user input before processing it,
including in SQL statements.

Impact
======

An attacker could execute arbitrary SQL statements on the underlying
database, or inject arbitrary scripts into the context of a user's
browser.

Workaround
==========

There is no known workaround at this time.

Resolution
==========

All Tikiwiki users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=www-apps/tikiwiki-1.9.4"

References
==========

[ 1 ] CVE-2006-3048
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3048
[ 2 ] CVE-2006-3047
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3047

Availability
============

This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:

http://security.gentoo.org/glsa/glsa-200606-29.xml

Concerns?
=========

Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or alternatively, you may file a bug at
http://bugs.gentoo.org.

License
=======

Copyright 2006 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).

The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.

http://creativecommons.org/licenses/by-sa/2.5