CVE-2014-4946

Name	CVE-2014-4946
Description	Multiple cross-site scripting (XSS) vulnerabilities in Horde Internet Mail Program (IMP) before 6.1.8, as used in Horde Groupware Webmail Edition before 5.1.5, allow remote attackers to inject arbitrary web script or HTML via (1) unspecified flags or (2) a mailbox name in the dynamic mailbox view.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
php-horde-imp (PTS)	buster	6.2.22-1	fixed
	bullseye	6.2.27-2	fixed
	bookworm, sid	6.2.27-3	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version
horde3	source	squeeze	(not affected)
horde3	source	(unstable)	(unfixed)
php-horde-imp	source	(unstable)	6.2.0-1

Notes

Upstream patches:
https://github.com/horde/horde/commit/578ff073724d9c179663098d8ff0076e8b361cfb
https://github.com/horde/horde/commit/2f1f4b10dec90fb67797ea80be0e029ead90f168
The bugs are in javascript files that do not exist in the version in Squeeze.