Version in base suite: 2.1.4-5 Base version: php-horde-data_2.1.4-5 Target version: php-horde-data_2.1.4-5+deb10u1 Base file: /srv/ftp-master.debian.org/ftp/pool/main/p/php-horde-data/php-horde-data_2.1.4-5.dsc Target file: /srv/ftp-master.debian.org/policy/pool/main/p/php-horde-data/php-horde-data_2.1.4-5+deb10u1.dsc changelog | 9 +++ patches/0001-CVE-2020-8518-Dont-use-create_function.patch | 36 ++++++++++++++ patches/series | 1 3 files changed, 46 insertions(+) diff -Nru php-horde-data-2.1.4/debian/changelog php-horde-data-2.1.4/debian/changelog --- php-horde-data-2.1.4/debian/changelog 2018-05-14 22:16:00.000000000 +0000 +++ php-horde-data-2.1.4/debian/changelog 2020-04-10 23:57:00.000000000 +0000 @@ -1,3 +1,12 @@ +php-horde-data (2.1.4-5+deb10u1) buster; urgency=high + + * Fix CVE-2020-8518: + The Horde Application Framework contained a remote code execution + vulnerability. An authenticated remote attacker could use this flaw to + cause execution of uploaded CSV data. (Closes: #951537) + + -- Roberto C. Sanchez Fri, 10 Apr 2020 19:57:00 -0400 + php-horde-data (2.1.4-5) unstable; urgency=medium * Update Standards-Version to 4.1.4, no change diff -Nru php-horde-data-2.1.4/debian/patches/0001-CVE-2020-8518-Dont-use-create_function.patch php-horde-data-2.1.4/debian/patches/0001-CVE-2020-8518-Dont-use-create_function.patch --- php-horde-data-2.1.4/debian/patches/0001-CVE-2020-8518-Dont-use-create_function.patch 1970-01-01 00:00:00.000000000 +0000 +++ php-horde-data-2.1.4/debian/patches/0001-CVE-2020-8518-Dont-use-create_function.patch 2020-04-10 23:57:00.000000000 +0000 @@ -0,0 +1,36 @@ +From 78ad0c2390176cdde7260a271bc6ddd86f4c9c0e Mon Sep 17 00:00:00 2001 +From: Jan Schneider +Date: Mon, 13 Feb 2017 18:38:59 +0100 +Subject: [PATCH] Don't use create_function(). + +It's deprecated and unsafe and closures should be used instead. +--- + lib/Horde/Data/Csv.php | 15 ++++++++++++++- + 1 file changed, 14 insertions(+), 1 deletion(-) + +diff --git a/Horde_Data-2.1.4/lib/Horde/Data/Csv.php b/Horde_Data-2.1.4/lib/Horde/Data/Csv.php +index c2dc7dc..c0ffa63 100644 +--- a/Horde_Data-2.1.4/lib/Horde/Data/Csv.php ++++ b/Horde_Data-2.1.4/lib/Horde/Data/Csv.php +@@ -332,7 +332,20 @@ public static function getCsv($file, array $params = array()) + + if ($row) { + $row = (strlen($params['quote']) && strlen($params['escape'])) +- ? array_map(create_function('$a', 'return str_replace(\'' . str_replace('\'', '\\\'', $params['escape'] . $params['quote']) . '\', \'' . str_replace('\'', '\\\'', $params['quote']) . '\', $a);'), $row) ++ ? array_map( ++ function ($a) use ($params) { ++ return str_replace( ++ str_replace( ++ '\'', ++ '\\\'', ++ $params['escape'] . $params['quote'] ++ ), ++ str_replace('\'', '\\\'', $params['quote']), ++ $a ++ ); ++ }, ++ $row ++ ) + : array_map('trim', $row); + + if (!empty($params['length'])) { diff -Nru php-horde-data-2.1.4/debian/patches/series php-horde-data-2.1.4/debian/patches/series --- php-horde-data-2.1.4/debian/patches/series 1970-01-01 00:00:00.000000000 +0000 +++ php-horde-data-2.1.4/debian/patches/series 2020-04-10 23:57:00.000000000 +0000 @@ -0,0 +1 @@ +0001-CVE-2020-8518-Dont-use-create_function.patch