CVE-2012-6640: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site scripting (XSS) vulnerability in Horde Internet Mail Program (IMP) before 5.0.22, as used in Horde Groupware Webmail Edition before 4.0.9, allows remote attackers to inject arbitrary web script or HTML via a crafted SVG image attachment, a different vulnerability than CVE-2012-5565.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Published: 2014-04-05T21:55Z
Repository: https://github.com/horde/horde
Language: Other
Files changed: imp/docs/CHANGES, imp/docs/RELEASE_NOTES
Commit date: 2012-06-26 13:30:01 +0200
Commit message: Prepare release.

Diff: diff --git a/imp/docs/CHANGES b/imp/docs/CHANGES
index 8456cb3996..9aeea1d1cb 100644
--- a/imp/docs/CHANGES
+++ b/imp/docs/CHANGES
@@ -1,10 +1,10 @@
 -----------
 v5.0.22-git
 -----------
 
-[mms] Only allow display of basic image types directly in browser.
+[mms] SECURITY: Only allow display of basic image types directly in browser.
 [jan] Update Turkish translation (İstanbul Technical University).
 [jan] Re-add option to report messages as spam/ham through redirection.
 [jan] Update Swedish translation (Jakob Alvermark
       <jakob.alvermark@bsdlabs.com>).
 
diff --git a/imp/docs/RELEASE_NOTES b/imp/docs/RELEASE_NOTES
index d21735ed51..429f7094a7 100644
--- a/imp/docs/RELEASE_NOTES
+++ b/imp/docs/RELEASE_NOTES
@@ -8,38 +8,38 @@
  * Horde_Release::FOCUS_MAJORBUG - Major bugfixes
  * Horde_Release::FOCUS_MINORSECURITY - Minor security fixes
  * Horde_Release::FOCUS_MAJORSECURITY - Major security fixes
  * Horde_Release::FOCUS_DOCS - Documentation improvements
  */
-$this->notes['fm']['focus'] = array(Horde_Release::FOCUS_MINORSECURITY, Horde_Release::FOCUS_MINORBUG, Horde_Release::FOCUS_MINORFEATURE);
+$this->notes['fm']['focus'] = array(Horde_Release::FOCUS_MINORSECURITY, Horde_Release::FOCUS_MINORFEATURE);
 
 /* Mailing list release notes. */
 $this->notes['ml']['changes'] = <<<ML
 The Horde Team is pleased to announce the final release of the Internet Mail
-Program (IMP) version H4 (5.0.21).
+Program (IMP) version H4 (5.0.22).
+
+Thanks to Mike Cardwell (https://grepular.com/) for reporting the SVG
+vulnerability.
 
 IMP, the Internet Mail Program, is one of the most popular and widely deployed
 open source webmail applications in the world. It allows universal, web-based
 access to IMAP and POP3 mail servers and provides Ajax, mobile and traditional
 interfaces with a rich range of features normally found only in desktop email
 clients. For more information on IMP, visit http://www.horde.org/apps/imp.
 
-The major changes compared to the IMP version H4 (5.0.20) are:
-    * Fixed XSS vulnerabilities.
-    * Fixed regression in PGP support.
-    * Improved HTML editor support.
-    * Updated Czech, Italian, and Slovak translations.
-    * Small bugfixes and improvements.
+The major changes compared to the IMP version H4 (5.0.21) are:
+    * Only display basic image attachments in the browser to avoid XSS
+      vulnerabilities triggered by opening malicious SVG attachments.
+    * Re-added option to report messages as spam/ham through redirection.
+    * Updated Swedish and Turkish translations.
 ML;
 
 /* Freshmeat release notes, not more than 600 characters. */
 $this->notes['fm']['changes'] = <<<FM
-Fixed XSS vulnerabilities.
-Fixed regression in PGP support.
-Improved HTML editor support.
-Updated Czech, Italian, and Slovak translations.
-Small bugfixes and improvements.
+Only display basic image attachments in the browser to avoid XSS vulnerabilities triggered by opening malicious SVG attachments.
+Re-added option to report messages as spam/ham through redirection.
+Updated Swedish and Turkish translations.
 FM;
 
 $this->notes['name'] = 'IMP';
 $this->notes['fm']['project'] = 'imp';
 $this->notes['fm']['branch'] = 'Horde 4';

Vulnerable code: [mms] Only allow display of basic image types directly in browser.
$this->notes['fm']['focus'] = array(Horde_Release::FOCUS_MINORSECURITY, Horde_Release::FOCUS_MINORBUG, Horde_Release::FOCUS_MINORFEATURE);
Program (IMP) version H4 (5.0.21).
The major changes compared to the IMP version H4 (5.0.20) are:
    * Fixed XSS vulnerabilities.
    * Fixed regression in PGP support.
    * Improved HTML editor support.
    * Updated Czech, Italian, and Slovak translations.
    * Small bugfixes and improvements.
Fixed XSS vulnerabilities.
Fixed regression in PGP support.
Improved HTML editor support.
Updated Czech, Italian, and Slovak translations.
Small bugfixes and improvements.
Fixed code: [mms] SECURITY: Only allow display of basic image types directly in browser.
$this->notes['fm']['focus'] = array(Horde_Release::FOCUS_MINORSECURITY, Horde_Release::FOCUS_MINORFEATURE);
Program (IMP) version H4 (5.0.22).

Thanks to Mike Cardwell (https://grepular.com/) for reporting the SVG
vulnerability.
The major changes compared to the IMP version H4 (5.0.21) are:
    * Only display basic image attachments in the browser to avoid XSS
      vulnerabilities triggered by opening malicious SVG attachments.
    * Re-added option to report messages as spam/ham through redirection.
    * Updated Swedish and Turkish translations.
Only display basic image attachments in the browser to avoid XSS vulnerabilities triggered by opening malicious SVG attachments.
Re-added option to report messages as spam/ham through redirection.
Updated Swedish and Turkish translations.