Debian Php-Horde-Turba vulnerabilities

CVE-2022-30287 [HIGH] CVE-2022-30287: php-horde-turba - Horde Groupware Webmail Edition through 5.2.22 allows a reflection injection att... Horde Groupware Webmail Edition through 5.2.22 allows a reflection injection attack through which an attacker can instantiate a driver class. This then leads to arbitrary deserialization of PHP objects. Scope: local bookworm: resolved (fixed in 4.2.25-6) bullseye: resolved (fixed in 4.2.25-5+deb11u2) sid: resolved (fixed in 4.2.25-6)

CVE-2013-6364 [HIGH] CVE-2013-6364: php-horde - Horde Groupware Webmail Edition has CSRF and XSS when saving search as a virtual... Horde Groupware Webmail Edition has CSRF and XSS when saving search as a virtual address book Scope: local bookworm: resolved bullseye: resolved sid: resolved