We recently became are of a cross site scripting exploit in the phpsysinfo module in phpGroupWare (CVE-2007-4048). This has been fixed in the 0.9.16.012 release.

There have been a lot of other bug fixes along the way too. Our support for PHP 5 has improved too.

All users are encouraged to upgrade. Grab phpGroupWare 0.9.16.012 from our download page now!

A security vulnerability has been discovered in phpGW < 0.9.16.011. We were not given a heads up before it was published.

The exploit is in the holiday code in calendar. It can only be exploited with register_globals = on and gpc_magic_quotes = off.

The advisory can be found at FrSIRT

There is code which exploits the vulnerability in the wild - see milw0rm.

All users are strongly encouraged to upgrade immediately.

You can grab the new version from our download section.

Or update from cvs
$ cd /path/to/phpgroupware
$ cvs update -dP

In addition to the security issue above, this release fixes support for MySQL4.1+ and pgsql 8. Support for php5 has been improved too, php5 should now work with zend.ze1_compatibility_mode on.

When grabbing your update, consider attending the phpGroupWare Conference Paris 2006.

The phpGroupWare Crew

phpGroupWare is proud to announce the latest stable version - 0.9.16.010. This release contains over 50 reported bugs fixed, a stack of patches and general polish.

This is release exceeds the normal high quality of a phpgroupware release and is probably the most stable release ever by the phpGroupWare team.

Please refer to the ChangeLog for details on the significant fixes.

The tarballs include updated CVS data so you can easily update. This is a result of the recent CVS changes at savannah.

Download it now!

Enjoy,

The phpGroupWare Crew

This release corrects an array hadling bug in the new anti XSS code introduced in 0.9.16.007.

As always you can grab it from our downloads section.

Cheers

The phpGroupWare Crew

This new release fixes several security issues within phpGroupWare. The fixes include:

• Global anti-XSS changes, related to savannah bug #13863
• FUDForum Information Disclosure - CAN-2005-2600
• Disabled XMLRPC until more resources are available - CAN-2005-2498

Disabling of XMLRPC is regrettable but unvoidable. phpGroupWare's XMLRPC code is a bastardized version of phpxmlrpc. Our XMLRPC code is currently unmaintained and we did not have the resources available to merge and test the changes require. Instead of delaying the release any more we chose to disable functionality. If you wish to contribute to fixing our XMLRPC support please contact skwashd at phpgroupware.org

As always grab it from our download section

Cheers

The phpGroupWare crew