CVE-2010-0463 Horde IMP 4.3.6 and earlier does not request that the web browser avoid DNS prefetching of domain names contained in e-mail messages, which makes it easier for remote attackers to determine the networ...
MediumCVSS 5.0
EPSS 2.0%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Horde IMP 4.3.6 and earlier does not request that the web browser avoid DNS prefetching of domain names contained in e-mail messages, which makes it easier for remote attackers to determine the network location of the webmail user by logging DNS requests.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| horde imp | <= 4.3.6 | No fix listed |
| horde imp | = 2.0 | No fix listed |
| horde imp | = 2.2 | No fix listed |
| horde imp | = 2.2.1 | No fix listed |
| horde imp | = 2.2.2 | No fix listed |
| horde imp | = 2.2.3 | No fix listed |
| horde imp | = 2.2.4 | No fix listed |
| horde imp | = 2.2.5 | No fix listed |
| horde imp | = 2.2.6 | No fix listed |
| horde imp | = 2.2.7 | No fix listed |
| horde imp | = 2.2.8 | No fix listed |
| horde imp | = 2.3 | No fix listed |
| horde imp | = 3.0 | No fix listed |
| horde imp | = 3.1 | No fix listed |
| horde imp | = 3.1.2 | No fix listed |
| horde imp | = 3.2 | No fix listed |
| horde imp | = 3.2.1 | No fix listed |
| horde imp | = 3.2.2 | No fix listed |
| horde imp | = 3.2.3 | No fix listed |
| horde imp | = 3.2.4 | No fix listed |
| horde imp | = 3.2.5 | No fix listed |
| horde imp | = 3.2.6 | No fix listed |
| horde imp | = 3.2.7 | No fix listed |
| horde imp | = 3.2.7-rc1 | No fix listed |
| horde imp | = 4.0 | No fix listed |
Show 16 more
| Product | Affected versions | Fixed in |
|---|---|---|
| horde imp | = 4.0.1 | No fix listed |
| horde imp | = 4.0.2 | No fix listed |
| horde imp | = 4.0.3 | No fix listed |
| horde imp | = 4.0.4 | No fix listed |
| horde imp | = 4.1.3 | No fix listed |
| horde imp | = 4.1.5 | No fix listed |
| horde imp | = 4.1.6 | No fix listed |
| horde imp | = 4.2 | No fix listed |
| horde imp | = 4.2.1 | No fix listed |
| horde imp | = 4.2.2 | No fix listed |
| horde imp | = 4.3 | No fix listed |
| horde imp | = 4.3.1 | No fix listed |
| horde imp | = 4.3.2 | No fix listed |
| horde imp | = 4.3.3 | No fix listed |
| horde imp | = 4.3.4 | No fix listed |
| horde imp | = 4.3.5 | No fix listed |
References
- bugs.horde.org patch
- horde-dns-info-disclosure(56052) vdb-entry
- secure.grepular.com