A cross-site scripting (XSS) flaw was found in the way Kronolith, the Horde calendar application, sanitized content of certain event location parameters passed to month, monthlist and prevmonthlist application fields. A remote attacker could provide a specially-crafted URL that, when visited would lead to arbitrary HTML or webscript execution.

References: [1] http://lists.horde.org/archives/announce/2012/000836.html [2] https://github.com/horde/horde/blob/d3dda2d47fad7eb128a0091e732cded0c2601009/kronolith/docs/CHANGES

Refevant upstream patch: [3] http://git.horde.org/horde-git/-/commit/d865c564beb6e98532880aa51a04a79f3311cd1e