CVE-2021-26929

Name	CVE-2021-26929
Description	An XSS issue was discovered in Horde Groupware Webmail Edition through 5.2.22 (where the Horde_Text_Filter library before 2.3.7 is used). The attacker can send a plain text e-mail message, with JavaScript encoded as a link or email that is mishandled by preProcess in Text2html.php, because bespoke use of \x00\x00\x00 and \x01\x01\x01 interferes with XSS defenses.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DLA-2564-1
Debian Bugs	982769

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
php-horde-text-filter (PTS)	buster	2.3.5-3+deb10u2	fixed
	sid, trixie, bookworm, bullseye	2.3.7-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Origin	Debian Bugs
php-horde-text-filter	source	stretch	2.3.5-1+deb9u1	DLA-2564-1
php-horde-text-filter	source	buster	2.3.5-3+deb10u2
php-horde-text-filter	source	(unstable)	2.3.7-1		982769

Notes

https://lists.horde.org/archives/announce/2021/001298.html
https://github.com/horde/Text_Filter/commit/c26f938854c36b981558a3b1b9b2f81403cff60e (master)
https://github.com/horde/Text_Filter/commit/a2f67da064d7a91440b7a2448e56a6387ab94c67 (v2.3.7)
https://www.alexbirnberg.com/horde-xss.html