Program: CWE-79
Project: CVE-2022-26874
Buggy source:
---
2.2.4:
  api: 2.1.0
  state:
    release: stable
    api: stable
  date: 2022-03-01
  license:
    identifier: LGPL-2.1
    uri: http://www.horde.org/licenses/lgpl21
  notes: |+
    
2.2.3:
  api: 2.1.0
  state:
    release: stable
    api: stable
  date: 2022-03-01
  license:
    identifier: LGPL-2.1
    uri: http://www.horde.org/licenses/lgpl21
  notes: |
    [jan] Fix XSS vulnerability in Open Document mime viewer (Reported by: Simon Scannell, SonarSource <simon.scannell@sonarsource.com>).
2.2.2:
  api: 2.1.0
  state:
    release: stable
    api: stable
  date: 2017-08-28
  license:
    identifier: LGPL-2.1
    uri: http://www.horde.org/licenses/lgpl21
  notes: |
    [jan] Fix bottom table line length of RAR archive summaries.
2.2.1:
  api: 2.1.0
  state:
    release: stable
    api: stable
  date: 2016-09-06
  license:
    identifier: LGPL-2.1
    uri: http://www.horde.org/licenses/lgpl21
  notes: |
    [jan] SECURITY: Don't render SVG images in the browser to avoid XSS attacks (Reported by Dawid Gounski via Beyond Security's SecuriTeam Secure Disclosure program).
2.2.0:
  api: 2.1.0
  state:
    release: stable
    api: stable
  date: 2016-07-28
  license:
    identifier: LGPL-2.1
    uri: http://www.horde.org/licenses/lgpl21
  notes: |
    [mjr] Add SyntaxHighlighter version 4 support.
2.1.3:
  api: 2.1.0
  state:
    release: stable
    api: stable
  date: 2016-03-21
  license:
    identifier: LGPL-2.1
    uri: http://www.horde.org/licenses/lgpl21
  notes: |
    [jan] Update Greek translation (Limperis Antonis <limperis@cti.gr>).
2.1.2:
  api: 2.1.0
  state:
    release: stable
    api: stable
  date: 2016-02-01
  license:
    identifier: LGPL-2.1
    uri: http://www.horde.org/licenses/lgpl21
  notes: |
    [jan] Add temp_dir configuration parameter to OpenOffice/LibreOffice viewer (Request #11756).
    [jan] Mark PHP 7 as supported.
2.1.1:
  api: 2.1.0
  state:
    release: stable
    api: stable
  date: 2015-07-31
  license:
    identifier: LGPL-2.1
    uri: http://www.horde.org/licenses/lgpl21
  notes: |
    [jan] Updated GL translation.
2.1.0:
  api: 2.1.0
  state:
    release: stable
    api: stable
  date: 2015-04-13
  license:
    identifier: LGPL-2.1
    uri: http://www.horde.org/licenses/lgpl21
  notes: |
    [mms] Add optional support to determine if link text is a hostname when doing phishing analysis for the HTML driver.
2.0.8:
  api: 1.0.0
  state:
    release: stable
    api: stable
  date: 2014-11-18
  license:
    identifier: LGPL-2.1
    uri: http://www.horde.org/licenses/lgpl21
  notes: |
    [mms] More thorough handling of tar.gz data.
2.0.7:
  api: 1.0.0
  state:
    release: stable
    api: stable
  date: 2014-05-21
  license:
    identifier: LGPL-2.1
    uri: http://www.horde.org/licenses/lgpl21
  notes: |
    [jan] Update Hungarian translation (Andras Galos <galosa@netinform.hu>).
2.0.6:
  api: 1.0.0
  state:
    release: stable
    api: stable
  date: 2014-04-03
  license:
    identifier: LGPL-2.1
    uri: http://www.horde.org/licenses/lgpl21
  notes: |
    [mms] Fix fatal error if using TNEF viewer and bcmath extension is not installed on the system.
2.0.5:
  api: 1.0.0
  state:
    release: stable
    api: stable
  date: 2013-05-28
  license:
    identifier: LGPL-2.1
    uri: http://www.horde.org/licenses/lgpl21
  notes: |
    [jan] Update Ukrainian translation (Andriy Kopystyansky <anri@polynet.lviv.ua>).
2.0.4:
  api: 1.0.0
  state:
    release: stable
    api: stable
  date: 2013-03-05
  license:
    identifier: LGPL-2.1
    uri: http://www.horde.org/licenses/lgpl21
  notes: |
    [mms] Spreadsheet conversion now works without using temporary files.
2.0.3:
  api: 1.0.0
  state:
    release: stable
    api: stable
  date: 2013-01-29
  license:
    identifier: LGPL-2.1
    uri: http://www.horde.org/licenses/lgpl21
  notes: |
    [jan] Update French translation (Paul De Vlieger <paul.de_vlieger@moniut.univ-bpclermont.fr>).
2.0.2:
  api: 1.0.0
  state:
    release: stable
    api: stable
  date: 2013-01-09
  license:
    identifier: LGPL-2.1
    uri: http://www.horde.org/licenses/lgpl21
  notes: |
    [jan] Add Basque translation (Ibon Igartua <ibon.igartua@ehu.es>).
    [jan] Update XSLT processor for OpenDocument files.
2.0.1:
  api: 1.0.0
  state:
    release: stable
    api: stable
  date: 2012-11-06
  license:
    identifier: LGPL-2.1
    uri: http://www.horde.org/licenses/lgpl21
  notes: |
    [jan] Update Dutch translation (Arjen de Korte <build+horde@de-korte.org>).
2.0.0:
  api: 1.0.0
  state:
    release: stable
    api: stable
  date: 2012-10-30
  license:
    identifier: LGPL-2.1
    uri: http://www.horde.org/licenses/lgpl21
  notes: |
    First stable release for Horde 5.
2.0.0RC1:
  api: 1.0.0
  state:
    release: beta
    api: stable
  date: 2012-10-26
  license:
    identifier: LGPL-2.1
    uri: http://www.horde.org/licenses/lgpl21
  notes: |
    [mms] Fix reading Debian archive data.
2.0.0beta1:
  api: 1.0.0
  state:
    release: beta
    api: stable
  date: 2012-07-19
  license:
    identifier: LGPL-2.1
    uri: http://www.horde.org/licenses/lgpl21
  notes: |
    First beta release for Horde 5.
2.0.0alpha1:
  api: 1.0.0
  state:
    release: alpha
    api: stable
  date: 2012-07-05
  license:
    identifier: LGPL-2.1
    uri: http://www.horde.org/licenses/lgpl21
  notes: |
    First alpha release for Horde 5.
1.0.9:
  api: 1.0.0
  state:
    release: stable
    api: stable
  date: false
  license:
    identifier: LGPL-2.1
    uri: http://www.horde.org/licenses/lgpl21
  notes: |
    [mms] Fix reading Debian archive data.
1.0.8:
  api: 1.0.0
  state:
    release: stable
    api: stable
  date: 2011-11-22
  license:
    identifier: LGPL-2.1
    uri: http://www.horde.org/licenses/lgpl21
  notes: |
    [jan] Add Croatian translation.
    [jan] Add Estonian translation.
1.0.7:
  api: 1.0.0
  state:
    release: stable
    api: stable
  date: 2011-11-02
  license:
    identifier: LGPL-2.1
    uri: http://www.horde.org/licenses/lgpl21
  notes: |
    [mms] Fix iteration through child HTML nodes in the HTML viewer so that extended viewers can do things like remove nodes outright.
1.0.6:
  api: 1.0.0
  state:
    release: stable
    api: stable
  date: 2011-10-11
  license:
    identifier: LGPL-2.1
    uri: http://www.horde.org/licenses/lgpl21
  notes: |
    [jan] Fix configuration of syntaxhighlighter viewer.
1.0.5:
  api: 1.0.0
  state:
    release: stable
    api: stable
  date: 2011-07-27
  license:
    identifier: LGPL-2.1
    uri: http://www.horde.org/licenses/lgpl21
  notes: |
    [jan] Update Latvian translation.
1.0.4:
  api: 1.0.0
  state:
    release: stable
    api: stable
  date: 2011-07-05
  license:
    identifier: LGPL-2.1
    uri: http://www.horde.org/licenses/lgpl21
  notes: |
    [jan] Update Lithuanian translation.
    [jan] Update Brazilian Portuguese translation.
    [gwr] Support restricting the HTML tidy post processing by the message size (Request #10266).
1.0.3:
  api: 1.0.0
  state:
    release: stable
    api: stable
  date: 2011-06-01
  license:
    identifier: LGPL-2.1
    uri: http://www.horde.org/licenses/lgpl21
  notes: |
    [jan] Updated Slovak translation.
1.0.2:
  api: 1.0.0
  state:
    release: stable
    api: stable
  date: 2011-05-18
  license:
    identifier: LGPL-2.1
    uri: http://www.horde.org/licenses/lgpl21
  notes: |
    [jan] Updated Spanish translation.
1.0.1:
  api: 1.0.0
  state:
    release: stable
    api: stable
  date: 2011-05-03
  license:
    identifier: LGPL-2.1
    uri: http://www.horde.org/licenses/lgpl21
  notes: |
    [jan] Improve Syntaxhighlighter rendering in Chrome browsers.
1.0.0:
  api: 1.0.0
  state:
    release: stable
    api: stable
  date: 2011-04-06
  license:
    identifier: LGPL-2.1
    uri: http://www.horde.org/licenses/lgpl21
  notes: |
    First stable release for Horde 4.
1.0.0RC2:
  api: 1.0.0
  state:
    release: beta
    api: beta
  date: 2011-03-29
  license:
    identifier: LGPL-2.1
    uri: http://www.horde.org/licenses/lgpl21
  notes: |
    Second release candidate for Horde 4.
    [jan] Fix OpenOffice MIME viewer.
1.0.0RC1:
  api: 1.0.0
  state:
    release: beta
    api: beta
  date: 2011-03-22
  license:
    identifier: LGPL-2.1
    uri: http://www.horde.org/licenses/lgpl21
  notes: |
    First release candidate for Horde 4.
1.0.0beta1:
  api: 1.0.0
  state:
    release: beta
    api: beta
  date: 2011-03-16
  license:
    identifier: LGPL-2.1
    uri: http://www.horde.org/licenses/lgpl21
  notes: |
    First beta release for Horde 4.
1.0.0alpha1:
  api: 1.0.0
  state:
    release: alpha
    api: alpha
  date: 2011-03-08
  license:
    identifier: LGPL-2.1
    uri: http://www.horde.org/licenses/lgpl21
  notes: |
    First alpha release for Horde 4.
    Replaced external or PHP-based syntax highlighters with javascript SyntaxHighlighter: http://alexgorbatchev.com/SyntaxHighlighter/


Fixed version (ground truth):
---
2.2.4:
  api: 2.1.0
  state:
    release: stable
    api: stable
  date: 2022-03-01
  license:
    identifier: LGPL-2.1
    uri: http://www.horde.org/licenses/lgpl21
  notes: |
    [jan] Fix XSS vulnerability in Open Document mime viewer with different code path (Reported by: Mahdi Pasche <pasche@b1-systems.de>).
    |+
2.2.3:
  api: 2.1.0
  state:
    release: stable
    api: stable
  date: 2022-03-01
  license:
    identifier: LGPL-2.1
    uri: http://www.horde.org/licenses/lgpl21
  notes: |
    [jan] Fix XSS vulnerability in Open Document mime viewer (Reported by: Simon Scannell, SonarSource <simon.scannell@sonarsource.com>).
2.2.2:
  api: 2.1.0
  state:
    release: stable
    api: stable
  date: 2017-08-28
  license:
    identifier: LGPL-2.1
    uri: http://www.horde.org/licenses/lgpl21
  notes: |
    [jan] Fix bottom table line length of RAR archive summaries.
2.2.1:
  api: 2.1.0
  state:
    release: stable
    api: stable
  date: 2016-09-06
  license:
    identifier: LGPL-2.1
    uri: http://www.horde.org/licenses/lgpl21
  notes: |
    [jan] SECURITY: Don't render SVG images in the browser to avoid XSS attacks (Reported by Dawid Gounski via Beyond Security's SecuriTeam Secure Disclosure program).
2.2.0:
  api: 2.1.0
  state:
    release: stable
    api: stable
  date: 2016-07-28
  license:
    identifier: LGPL-2.1
    uri: http://www.horde.org/licenses/lgpl21
  notes: |
    [mjr] Add SyntaxHighlighter version 4 support.
2.1.3:
  api: 2.1.0
  state:
    release: stable
    api: stable
  date: 2016-03-21
  license:
    identifier: LGPL-2.1
    uri: http://www.horde.org/licenses/lgpl21
  notes: |
    [jan] Update Greek translation (Limperis Antonis <limperis@cti.gr>).
2.1.2:
  api: 2.1.0
  state:
    release: stable
    api: stable
  date: 2016-02-01
  license:
    identifier: LGPL-2.1
    uri: http://www.horde.org/licenses/lgpl21
  notes: |
    [jan] Add temp_dir configuration parameter to OpenOffice/LibreOffice viewer (Request #11756).
    [jan] Mark PHP 7 as supported.
2.1.1:
  api: 2.1.0
  state:
    release: stable
    api: stable
  date: 2015-07-31
  license:
    identifier: LGPL-2.1
    uri: http://www.horde.org/licenses/lgpl21
  notes: |
    [jan] Updated GL translation.
2.1.0:
  api: 2.1.0
  state:
    release: stable
    api: stable
  date: 2015-04-13
  license:
    identifier: LGPL-2.1
    uri: http://www.horde.org/licenses/lgpl21
  notes: |
    [mms] Add optional support to determine if link text is a hostname when doing phishing analysis for the HTML driver.
2.0.8:
  api: 1.0.0
  state:
    release: stable
    api: stable
  date: 2014-11-18
  license:
    identifier: LGPL-2.1
    uri: http://www.horde.org/licenses/lgpl21
  notes: |
    [mms] More thorough handling of tar.gz data.
2.0.7:
  api: 1.0.0
  state:
    release: stable
    api: stable
  date: 2014-05-21
  license:
    identifier: LGPL-2.1
    uri: http://www.horde.org/licenses/lgpl21
  notes: |
    [jan] Update Hungarian translation (Andras Galos <galosa@netinform.hu>).
2.0.6:
  api: 1.0.0
  state:
    release: stable
    api: stable
  date: 2014-04-03
  license:
    identifier: LGPL-2.1
    uri: http://www.horde.org/licenses/lgpl21
  notes: |
    [mms] Fix fatal error if using TNEF viewer and bcmath extension is not installed on the system.
2.0.5:
  api: 1.0.0
  state:
    release: stable
    api: stable
  date: 2013-05-28
  license:
    identifier: LGPL-2.1
    uri: http://www.horde.org/licenses/lgpl21
  notes: |
    [jan] Update Ukrainian translation (Andriy Kopystyansky <anri@polynet.lviv.ua>).
2.0.4:
  api: 1.0.0
  state:
    release: stable
    api: stable
  date: 2013-03-05
  license:
    identifier: LGPL-2.1
    uri: http://www.horde.org/licenses/lgpl21
  notes: |
    [mms] Spreadsheet conversion now works without using temporary files.
2.0.3:
  api: 1.0.0
  state:
    release: stable
    api: stable
  date: 2013-01-29
  license:
    identifier: LGPL-2.1
    uri: http://www.horde.org/licenses/lgpl21
  notes: |
    [jan] Update French translation (Paul De Vlieger <paul.de_vlieger@moniut.univ-bpclermont.fr>).
2.0.2:
  api: 1.0.0
  state:
    release: stable
    api: stable
  date: 2013-01-09
  license:
    identifier: LGPL-2.1
    uri: http://www.horde.org/licenses/lgpl21
  notes: |
    [jan] Add Basque translation (Ibon Igartua <ibon.igartua@ehu.es>).
    [jan] Update XSLT processor for OpenDocument files.
2.0.1:
  api: 1.0.0
  state:
    release: stable
    api: stable
  date: 2012-11-06
  license:
    identifier: LGPL-2.1
    uri: http://www.horde.org/licenses/lgpl21
  notes: |
    [jan] Update Dutch translation (Arjen de Korte <build+horde@de-korte.org>).
2.0.0:
  api: 1.0.0
  state:
    release: stable
    api: stable
  date: 2012-10-30
  license:
    identifier: LGPL-2.1
    uri: http://www.horde.org/licenses/lgpl21
  notes: |
    First stable release for Horde 5.
2.0.0RC1:
  api: 1.0.0
  state:
    release: beta
    api: stable
  date: 2012-10-26
  license:
    identifier: LGPL-2.1
    uri: http://www.horde.org/licenses/lgpl21
  notes: |
    [mms] Fix reading Debian archive data.
2.0.0beta1:
  api: 1.0.0
  state:
    release: beta
    api: stable
  date: 2012-07-19
  license:
    identifier: LGPL-2.1
    uri: http://www.horde.org/licenses/lgpl21
  notes: |
    First beta release for Horde 5.
2.0.0alpha1:
  api: 1.0.0
  state:
    release: alpha
    api: stable
  date: 2012-07-05
  license:
    identifier: LGPL-2.1
    uri: http://www.horde.org/licenses/lgpl21
  notes: |
    First alpha release for Horde 5.
1.0.9:
  api: 1.0.0
  state:
    release: stable
    api: stable
  date: false
  license:
    identifier: LGPL-2.1
    uri: http://www.horde.org/licenses/lgpl21
  notes: |
    [mms] Fix reading Debian archive data.
1.0.8:
  api: 1.0.0
  state:
    release: stable
    api: stable
  date: 2011-11-22
  license:
    identifier: LGPL-2.1
    uri: http://www.horde.org/licenses/lgpl21
  notes: |
    [jan] Add Croatian translation.
    [jan] Add Estonian translation.
1.0.7:
  api: 1.0.0
  state:
    release: stable
    api: stable
  date: 2011-11-02
  license:
    identifier: LGPL-2.1
    uri: http://www.horde.org/licenses/lgpl21
  notes: |
    [mms] Fix iteration through child HTML nodes in the HTML viewer so that extended viewers can do things like remove nodes outright.
1.0.6:
  api: 1.0.0
  state:
    release: stable
    api: stable
  date: 2011-10-11
  license:
    identifier: LGPL-2.1
    uri: http://www.horde.org/licenses/lgpl21
  notes: |
    [jan] Fix configuration of syntaxhighlighter viewer.
1.0.5:
  api: 1.0.0
  state:
    release: stable
    api: stable
  date: 2011-07-27
  license:
    identifier: LGPL-2.1
    uri: http://www.horde.org/licenses/lgpl21
  notes: |
    [jan] Update Latvian translation.
1.0.4:
  api: 1.0.0
  state:
    release: stable
    api: stable
  date: 2011-07-05
  license:
    identifier: LGPL-2.1
    uri: http://www.horde.org/licenses/lgpl21
  notes: |
    [jan] Update Lithuanian translation.
    [jan] Update Brazilian Portuguese translation.
    [gwr] Support restricting the HTML tidy post processing by the message size (Request #10266).
1.0.3:
  api: 1.0.0
  state:
    release: stable
    api: stable
  date: 2011-06-01
  license:
    identifier: LGPL-2.1
    uri: http://www.horde.org/licenses/lgpl21
  notes: |
    [jan] Updated Slovak translation.
1.0.2:
  api: 1.0.0
  state:
    release: stable
    api: stable
  date: 2011-05-18
  license:
    identifier: LGPL-2.1
    uri: http://www.horde.org/licenses/lgpl21
  notes: |
    [jan] Updated Spanish translation.
1.0.1:
  api: 1.0.0
  state:
    release: stable
    api: stable
  date: 2011-05-03
  license:
    identifier: LGPL-2.1
    uri: http://www.horde.org/licenses/lgpl21
  notes: |
    [jan] Improve Syntaxhighlighter rendering in Chrome browsers.
1.0.0:
  api: 1.0.0
  state:
    release: stable
    api: stable
  date: 2011-04-06
  license:
    identifier: LGPL-2.1
    uri: http://www.horde.org/licenses/lgpl21
  notes: |
    First stable release for Horde 4.
1.0.0RC2:
  api: 1.0.0
  state:
    release: beta
    api: beta
  date: 2011-03-29
  license:
    identifier: LGPL-2.1
    uri: http://www.horde.org/licenses/lgpl21
  notes: |
    Second release candidate for Horde 4.
    [jan] Fix OpenOffice MIME viewer.
1.0.0RC1:
  api: 1.0.0
  state:
    release: beta
    api: beta
  date: 2011-03-22
  license:
    identifier: LGPL-2.1
    uri: http://www.horde.org/licenses/lgpl21
  notes: |
    First release candidate for Horde 4.
1.0.0beta1:
  api: 1.0.0
  state:
    release: beta
    api: beta
  date: 2011-03-16
  license:
    identifier: LGPL-2.1
    uri: http://www.horde.org/licenses/lgpl21
  notes: |
    First beta release for Horde 4.
1.0.0alpha1:
  api: 1.0.0
  state:
    release: alpha
    api: alpha
  date: 2011-03-08
  license:
    identifier: LGPL-2.1
    uri: http://www.horde.org/licenses/lgpl21
  notes: |
    First alpha release for Horde 4.
    Replaced external or PHP-based syntax highlighters with javascript SyntaxHighlighter: http://alexgorbatchev.com/SyntaxHighlighter/