CVE-2013-6364

Name	CVE-2013-6364
Description	Horde Groupware Webmail Edition has CSRF and XSS when saving search as a virtual address book
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	730979

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
php-horde (PTS)	sid, bookworm	5.2.23+debian0-6	fixed
php-horde-turba (PTS)	sid, bookworm	4.2.29-2	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Debian Bugs
php-horde	source	(unstable)	(not affected)
php-horde-turba	source	(unstable)	4.1.3-1		730979
turba2	source	squeeze	(unfixed)	end-of-life
turba2	source	(unstable)	(unfixed)

Notes

- php-horde <not-affected> (Vulnerable code in turba)
[squeeze] - turba2 <end-of-life> (Unsupported in squeeze-lts)
https://github.com/horde/horde/commit/74f9add4ad86c29b608270e33b17426163b3c8cf