CVE-2017-7413
High · 8.8CVSS
8.8
EPSS
39.2%
Published
Apr 4, 2017
CISA due date
—
The record
In Horde_Crypt before 2.7.6, as used in Horde Groupware Webmail Edition through 5.2.17, OS Command Injection can occur if the attacker is an authenticated Horde Webmail user, has PGP features enabled in their preferences, and attempts to encrypt an email addressed to a maliciously crafted email address.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Debian:11 | php-horde-crypt | 0 | 2.7.5-2 |
| Debian:12 | php-horde-crypt | 0 | 2.7.5-2 |
| Debian:13 | php-horde-crypt | 0 | 2.7.5-2 |
| Debian:8 | php-horde-crypt | 0 | 2.5.0-5+deb8u1 |
| Ubuntu:16.04:LTS | php-horde-crypt | 0 | No fix |
| Ubuntu:18.04:LTS | php-horde-crypt | 0 | 2.7.11-1ubuntu1 |
| Ubuntu:Pro:16.04:LTS | php-horde-crypt | 0 | No fix |
Related vulnerabilities
- CVE-2026-96376 Improper Neutralization of Special Elements used in an OS Command ("OS Command… CWE-78
- CVE-2026-113732 virtualenv is a tool for creating isolated virtual python environments. CWE-78
- CVE-2026-113776 virtualenv is a tool for creating isolated virtual python environments. CWE-78
- CVE-2026-113726 virtualenv is a tool for creating isolated virtual python environments. CWE-78
- CVE-2026-113725 virtualenv is a tool for creating isolated virtual python environments. CWE-78
- CVE-2026-113722 virtualenv is a tool for creating isolated virtual python environments. CWE-78
- CVE-2026-112943 launch-editor allows users to open files with line numbers in editor from Node.js. CWE-78
- CVE-2026-112900 Pillow is a Python imaging library. CWE-78