eGroupWare: Remote code execution — GLSA 201711-12

Multiple vulnerabilities have been found in eGroupWare, the worst of which allows remote attackers to execute arbitrary code.

Affected Packages

www-apps/egroupware on all architectures
Affected versions <= 1.8.004.20120613
Unaffected versions

Background

eGroupWare is a suite of web-based group applications including calendar, address book, messenger and email.

Description

It was found that eGroupWare contains multiple code injection vulnerabilities in multiple parameters and routes because of improper input sanitization.

Impact

A remote attacker could execute arbitrary code, delete arbitrary files or inject arbitrary PHP objects via multiple routes.

Workaround

There is no known workaround at this time.

Resolution

Gentoo has discontinued support for eGroupWare and recommends that users unmerge the package:

 # emerge --unmerge "www-apps/egroupware"
 

References

Release Date
November 12, 2017

Latest Revision
November 13, 2017: 2

Severity
normal

Exploitable
remote

Bugzilla entries