Multiple PHPGroupWare HTML Injection Vulnerabilities

Multiple PHPGroupWare HTML Injection Vulnerabilities

Solution:
The vendor has addressed this issue in phpGroupWare 0.9.14.005.

Mandrake has released an advisory (MDKSA-2003:077) that addresses this issue. Please see the attached advisory for details on obtaining and applying fixes.

Conectiva has released an advisory (CLA-2003:697) that addresses this issue. Please see the attached advisory for details on obtaining and applying fixes.

Debian has released advisory DSA 365-1 with fixes to address this issue. See referenced advisory for additional information.

Fixes are available:

PHPGroupWare PHPGroupWare 0.9.12

Conectiva phpgroupware-0.9.14.005-1U70_2cl.noarch.rpm
ftp://atualizacoes.conectiva.com.br/7.0/RPMS/phpgroupware-0.9.14.005-1 U70_2cl.noarch.rpm

Conectiva phpgroupware-0.9.14.005-1U80_2cl.noarch.rpm
ftp://atualizacoes.conectiva.com.br/8/RPMS/phpgroupware-0.9.14.005-1U8 0_2cl.noarch.rpm

Conectiva phpgroupware-0.9.14.005-9432U90_2cl.noarch.rpm
ftp://atualizacoes.conectiva.com.br/9/RPMS/phpgroupware-0.9.14.005-943 2U90_2cl.noarch.rpm

phpGroupWare phpGroupWare 0.9.14.005
http://www.phpgroupware.org/downloads/

PHPGroupWare PHPGroupWare 0.9.13

phpGroupWare phpGroupWare 0.9.14.005
http://www.phpgroupware.org/downloads/

PHPGroupWare PHPGroupWare 0.9.14 .003

Debian phpgroupware-addressbook_0.9.14-0.RC3.2.woody3_all.deb
Debian GNU/Linux 3.0 (woody)
http://security.debian.org/pool/updates/main/p/phpgroupware/phpgroupwa re-addressbook_0.9.14-0.RC3.2.woody3_all.deb

Debian phpgroupware-admin_0.9.14-0.RC3.2.woody3_all.deb
Debian GNU/Linux 3.0 (woody)
http://security.debian.org/pool/updates/main/p/phpgroupware/phpgroupwa re-admin_0.9.14-0.RC3.2.woody3_all.deb

Debian phpgroupware-api-doc_0.9.14-0.RC3.2.woody3_all.deb
Debian GNU/Linux 3.0 (woody)
http://security.debian.org/pool/updates/main/p/phpgroupware/phpgroupwa re-api-doc_0.9.14-0.RC3.2.woody3_all.deb

Debian phpgroupware-api_0.9.14-0.RC3.2.woody3_all.deb
Debian GNU/Linux 3.0 (woody)
http://security.debian.org/pool/updates/main/p/phpgroupware/phpgroupwa re-api_0.9.14-0.RC3.2.woody3_all.deb

Debian phpgroupware-bookkeeping_0.9.14-0.RC3.2.woody3_all.deb
Debian GNU/Linux 3.0 (woody)
http://security.debian.org/pool/updates/main/p/phpgroupware/phpgroupwa re-bookkeeping_0.9.14-0.RC3.2.woody3_all.deb

Debian phpgroupware-bookmarks_0.9.14-0.RC3.2.woody3_all.deb
Debian GNU/Linux 3.0 (woody)
http://security.debian.org/pool/updates/main/p/phpgroupware/phpgroupwa re-bookmarks_0.9.14-0.RC3.2.woody3_all.deb

Debian phpgroupware-brewer_0.9.14-0.RC3.2.woody3_all.deb
Debian GNU/Linux 3.0 (woody)
http://security.debian.org/pool/updates/main/p/phpgroupware/phpgroupwa re-brewer_0.9.14-0.RC3.2.woody3_all.deb

Debian phpgroupware-calendar_0.9.14-0.RC3.2.woody3_all.deb
Debian GNU/Linux 3.0 (woody)
http://security.debian.org/pool/updates/main/p/phpgroupware/phpgroupwa re-calendar_0.9.14-0.RC3.2.woody3_all.deb

Debian phpgroupware-chat_0.9.14-0.RC3.2.woody3_all.deb
Debian GNU/Linux 3.0 (woody)
http://security.debian.org/pool/updates/main/p/phpgroupware/phpgroupwa re-chat_0.9.14-0.RC3.2.woody3_all.deb

Debian phpgroupware-chora_0.9.14-0.RC3.2.woody3_all.deb
Debian GNU/Linux 3.0 (woody)
http://security.debian.org/pool/updates/main/p/phpgroupware/phpgroupwa re-chora_0.9.14-0.RC3.2.woody3_all.deb

Debian phpgroupware-comic_0.9.14-0.RC3.2.woody3_all.deb
Debian GNU/Linux 3.0 (woody)
http://security.debian.org/pool/updates/main/p/phpgroupware/phpgroupwa re-comic_0.9.14-0.RC3.2.woody3_all.deb

Debian phpgroupware-core-doc_0.9.14-0.RC3.2.woody3_all.deb
Debian GNU/Linux 3.0 (woody)
http://security.debian.org/pool/updates/main/p/phpgroupware/phpgroupwa re-core-doc_0.9.14-0.RC3.2.woody3_all.deb

Debian phpgroupware-core_0.9.14-0.RC3.2.woody3_all.deb
Debian GNU/Linux 3.0 (woody)
http://security.debian.org/pool/updates/main/p/phpgroupware/phpgroupwa re-core_0.9.14-0.RC3.2.woody3_all.deb

Debian phpgroupware-developer-tools_0.9.14-0.RC3.2.woody3_all.deb
Debian GNU/Linux 3.0 (woody)
http://security.debian.org/pool/updates/main/p/phpgroupware/phpgroupwa re-developer-tools_0.9.14-0.RC3.2.woody3_all.deb

Debian phpgroupware-dj_0.9.14-0.RC3.2.woody3_all.deb
Debian GNU/Linux 3.0 (woody)
http://security.debian.org/pool/updates/main/p/phpgroupware/phpgroupwa re-dj_0.9.14-0.RC3.2.woody3_all.deb

Debian phpgroupware-eldaptir_0.9.14-0.RC3.2.woody3_all.deb
Debian GNU/Linux 3.0 (woody)
http://security.debian.org/pool/updates/main/p/phpgroupware/phpgroupwa re-eldaptir_0.9.14-0.RC3.2.woody3_all.deb

Debian phpgroupware-email_0.9.14-0.RC3.2.woody3_all.deb
Debian GNU/Linux 3.0 (woody)
http://security.debian.org/pool/updates/main/p/phpgroupware/phpgroupwa re-email_0.9.14-0.RC3.2.woody3_all.deb

Debian phpgroupware-filemanager_0.9.14-0.RC3.2.woody3_all.deb
Debian GNU/Linux 3.0 (woody)
http://security.debian.org/pool/updates/main/p/phpgroupware/phpgroupwa re-filemanager_0.9.14-0.RC3.2.woody3_all.deb

Debian phpgroupware-forum_0.9.14-0.RC3.2.woody3_all.deb
Debian GNU/Linux 3.0 (woody)
http://security.debian.org/pool/updates/main/p/phpgroupware/phpgroupwa re-forum_0.9.14-0.RC3.2.woody3_all.deb

Debian phpgroupware-ftp_0.9.14-0.RC3.2.woody3_all.deb
Debian GNU/Linux 3.0 (woody)
http://security.debian.org/pool/updates/main/p/phpgroupware/phpgroupwa re-ftp_0.9.14-0.RC3.2.woody3_all.deb

Debian phpgroupware-headlines_0.9.14-0.RC3.2.woody3_all.deb
Debian GNU/Linux 3.0 (woody)
http://security.debian.org/pool/updates/main/p/phpgroupware/phpgroupwa re-headlines_0.9.14-0.RC3.2.woody3_all.deb

Debian phpgroupware-hr_0.9.14-0.RC3.2.woody3_all.deb
Debian GNU/Linux 3.0 (woody)
http://security.debian.org/pool/updates/main/p/phpgroupware/phpgroupwa re-hr_0.9.14-0.RC3.2.woody3_all.deb

Debian phpgroupware-img_0.9.14-0.RC3.2.woody3_all.deb
Debian GNU/Linux 3.0 (woody)
http://security.debian.org/pool/updates/main/p/phpgroupware/phpgroupwa re-img_0.9.14-0.RC3.2.woody3_all.deb

Debian phpgroupware-infolog_0.9.14-0.RC3.2.woody3_all.deb
Debian GNU/Linux 3.0 (woody)
http://security.debian.org/pool/updates/main/p/phpgroupware/phpgroupwa re-infolog_0.9.14-0.RC3.2.woody3_all.deb

Debian phpgroupware-inv_0.9.14-0.RC3.2.woody3_all.deb
Debian GNU/Linux 3.0 (woody)
http://security.debian.org/pool/updates/main/p/phpgroupware/phpgroupwa re-inv_0.9.14-0.RC3.2.woody3_all.deb

Debian phpgroupware-manual_0.9.14-0.RC3.2.woody3_all.deb
Debian GNU/Linux 3.0 (woody)
http://security.debian.org/pool/updates/main/p/phpgroupware/phpgroupwa re-manual_0.9.14-0.RC3.2.woody3_all.deb

Debian phpgroupware-messenger_0.9.14-0.RC3.2.woody3_all.deb
Debian GNU/Linux 3.0 (woody)
http://security.debian.org/pool/updates/main/p/phpgroupware/phpgroupwa re-messenger_0.9.14-0.RC3.2.woody3_all.deb

Debian phpgroupware-napster_0.9.14-0.RC3.2.woody3_all.deb
Debian GNU/Linux 3.0 (woody)
http://security.debian.org/pool/updates/main/p/phpgroupware/phpgroupwa re-napster_0.9.14-0.RC3.2.woody3_all.deb

Debian phpgroupware-news-admin_0.9.14-0.RC3.2.woody3_all.deb
Debian GNU/Linux 3.0 (woody)
http://security.debian.org/pool/updates/main/p/phpgroupware/phpgroupwa re-news-admin_0.9.14-0.RC3.2.woody3_all.deb

Debian phpgroupware-nntp_0.9.14-0.RC3.2.woody3_all.deb
Debian GNU/Linux 3.0 (woody)
http://security.debian.org/pool/updates/main/p/phpgroupware/phpgroupwa re-nntp_0.9.14-0.RC3.2.woody3_all.deb

Debian phpgroupware-notes_0.9.14-0.RC3.2.woody3_all.deb
Debian GNU/Linux 3.0 (woody)
http://security.debian.org/pool/updates/main/p/phpgroupware/phpgroupwa re-notes_0.9.14-0.RC3.2.woody3_all.deb

Debian phpgroupware-phonelog_0.9.14-0.RC3.2.woody3_all.deb
Debian GNU/Linux 3.0 (woody)
http://security.debian.org/pool/updates/main/p/phpgroupware/phpgroupwa re-phonelog_0.9.14-0.RC3.2.woody3_all.deb

Debian phpgroupware-phpsysinfo_0.9.14-0.RC3.2.woody3_all.deb
Debian GNU/Linux 3.0 (woody)
http://security.debian.org/pool/updates/main/p/phpgroupware/phpgroupwa re-phpsysinfo_0.9.14-0.RC3.2.woody3_all.deb

Debian phpgroupware-phpwebhosting_0.9.14-0.RC3.2.woody3_all.deb
Debian GNU/Linux 3.0 (woody)
http://security.debian.org/pool/updates/main/p/phpgroupware/phpgroupwa re-phpwebhosting_0.9.14-0.RC3.2.woody3_all.deb

Debian phpgroupware-polls_0.9.14-0.RC3.2.woody3_all.deb
Debian GNU/Linux 3.0 (woody)
http://security.debian.org/pool/updates/main/p/phpgroupware/phpgroupwa re-polls_0.9.14-0.RC3.2.woody3_all.deb

Debian phpgroupware-preferences_0.9.14-0.RC3.2.woody3_all.deb
Debian GNU/Linux 3.0 (woody)
http://security.debian.org/pool/updates/main/p/phpgroupware/phpgroupwa re-preferences_0.9.14-0.RC3.2.woody3_all.deb

Debian phpgroupware-projects_0.9.14-0.RC3.2.woody3_all.deb
Debian GNU/Linux 3.0 (woody)
http://security.debian.org/pool/updates/main/p/phpgroupware/phpgroupwa re-projects_0.9.14-0.RC3.2.woody3_all.deb

Debian phpgroupware-registration_0.9.14-0.RC3.2.woody3_all.deb
Debian GNU/Linux 3.0 (woody)
http://security.debian.org/pool/updates/main/p/phpgroupware/phpgroupwa re-registration_0.9.14-0.RC3.2.woody3_all.deb

Debian phpgroupware-setup_0.9.14-0.RC3.2.woody3_all.deb
Debian GNU/Linux 3.0 (woody)
http://security.debian.org/pool/updates/main/p/phpgroupware/phpgroupwa re-setup_0.9.14-0.RC3.2.woody3_all.deb

Debian phpgroupware-skel_0.9.14-0.RC3.2.woody3_all.deb
Debian GNU/Linux 3.0 (woody)
http://security.debian.org/pool/updates/main/p/phpgroupware/phpgroupwa re-skel_0.9.14-0.RC3.2.woody3_all.deb

Debian phpgroupware-soap_0.9.14-0.RC3.2.woody3_all.deb
Debian GNU/Linux 3.0 (woody)
http://security.debian.org/pool/updates/main/p/phpgroupware/phpgroupwa re-soap_0.9.14-0.RC3.2.woody3_all.deb

Debian phpgroupware-stocks_0.9.14-0.RC3.2.woody3_all.deb
Debian GNU/Linux 3.0 (woody)
http://security.debian.org/pool/updates/main/p/phpgroupware/phpgroupwa re-stocks_0.9.14-0.RC3.2.woody3_all.deb

Debian phpgroupware-todo_0.9.14-0.RC3.2.woody3_all.deb
Debian GNU/Linux 3.0 (woody)
http://security.debian.org/pool/updates/main/p/phpgroupware/phpgroupwa re-todo_0.9.14-0.RC3.2.woody3_all.deb

Debian phpgroupware-tts_0.9.14-0.RC3.2.woody3_all.deb
Debian GNU/Linux 3.0 (woody)
http://security.debian.org/pool/updates/main/p/phpgroupware/phpgroupwa re-tts_0.9.14-0.RC3.2.woody3_all.deb

Debian phpgroupware-wap_0.9.14-0.RC3.2.woody3_all.deb
Debian GNU/Linux 3.0 (woody)
http://security.debian.org/pool/updates/main/p/phpgroupware/phpgroupwa re-wap_0.9.14-0.RC3.2.woody3_all.deb

Debian phpgroupware-weather_0.9.14-0.RC3.2.woody3_all.deb
Debian GNU/Linux 3.0 (woody)
http://security.debian.org/pool/updates/main/p/phpgroupware/phpgroupwa re-weather_0.9.14-0.RC3.2.woody3_all.deb

Debian phpgroupware-xmlrpc_0.9.14-0.RC3.2.woody3_all.deb
Debian GNU/Linux 3.0 (woody)
http://security.debian.org/pool/updates/main/p/phpgroupware/phpgroupwa re-xmlrpc_0.9.14-0.RC3.2.woody3_all.deb

Debian phpgroupware_0.9.14-0.RC3.2.woody3_all.deb
Debian GNU/Linux 3.0 (woody)
http://security.debian.org/pool/updates/main/p/phpgroupware/phpgroupwa re_0.9.14-0.RC3.2.woody3_all.deb

phpGroupWare phpGroupWare 0.9.14.005
http://www.phpgroupware.org/downloads/

MandrakeSoft Corporate Server 2.1

Mandrake phpgroupware-0.9.14.006-0.1mdk.noarch.rpm
Corporate Server 2.1
http://www.mandrakesecure.net/en/ftp.php

Mandrake phpgroupware-0.9.14.006-0.1mdk.noarch.rpm
Corporate Server 2.1/x86_64
http://www.mandrakesecure.net/en/ftp.php

Mandrake phpgroupware-0.9.14.006-0.1mdk.src.rpm
http://www.mandrakesecure.net/en/ftp.php

Mandrake phpgroupware-0.9.14.006-0.1mdk.src.rpm
x86_64
http://www.mandrakesecure.net/en/ftp.php

MandrakeSoft Linux Mandrake 8.2 ppc

Mandrake phpgroupware-0.9.14.006-0.1mdk.noarch.rpm
8.2/PPC
http://www.mandrakesecure.net/en/ftp.php

Mandrake phpgroupware-0.9.14.006-0.1mdk.src.rpm
8.2/PPC
http://www.mandrakesecure.net/en/ftp.php

MandrakeSoft Linux Mandrake 8.2

Mandrake phpgroupware-0.9.14.006-0.1mdk.noarch.rpm
8.2
http://www.mandrakesecure.net/en/ftp.php

Mandrake phpgroupware-0.9.14.006-0.1mdk.src.rpm
8.2
http://www.mandrakesecure.net/en/ftp.php

MandrakeSoft Linux Mandrake 9.0

Mandrake phpgroupware-0.9.14.006-0.1mdk.noarch.rpm
9.0
http://www.mandrakesecure.net/en/ftp.php

Mandrake phpgroupware-0.9.14.006-0.1mdk.src.rpm
9.0
http://www.mandrakesecure.net/en/ftp.php

MandrakeSoft Linux Mandrake 9.1

Mandrake phpgroupware-0.9.14.006-0.1mdk.noarch.rpm
9.1
http://www.mandrakesecure.net/en/ftp.php

Mandrake phpgroupware-0.9.14.006-0.1mdk.src.rpm
9.1
http://www.mandrakesecure.net/en/ftp.php

MandrakeSoft Linux Mandrake 9.1 ppc

Mandrake phpgroupware-0.9.14.006-0.1mdk.noarch.rpm
9.1/PPC
http://www.mandrakesecure.net/en/ftp.php

Mandrake phpgroupware-0.9.14.006-0.1mdk.src.rpm
9.1/PPC
http://www.mandrakesecure.net/en/ftp.php