Secunia

Some vulnerabilities have been reported in Horde Groupware and Horde Groupware Webmail Edition, which can be exploited by malicious people to conduct cross-site scripting and script insertion attacks and by malicious users to compromise a vulnerable system.

1) Two vulnerabilities can be exploited to conduct cross-site scripting or script insertion attacks.

For more information see vulnerabilities #2 and #3 in:
SA36665

2) An error within the form library of the Horde Application Framework when handling image form fields can be exploited to overwrite arbitrary local files.

For more information see vulnerability #1 in:
SA36665

Note: This only affects the 1.2.x branch. Successful exploitation requires that the attacker has write permissions to the address book.

Solution
Update to version 1.1.6 or 1.2.4 or apply patches.
Further details available in Customer Area

Provided and/or discovered by
1) Martin Geisler and David Wharton
2) Stefan Esser, Sektion1

Changelog
Further details available in Customer Area

Original Advisory
http://marc.info/?l=horde-announce&m=125292314007049&w=2
http://marc.info/?l=horde-announce&m=125292088004087&w=2
http://marc.info/?l=horde-announce&m=125294558611682&w=2
http://marc.info/?l=horde-announce&m=125295852706029&w=2
http://bugs.horde.org/ticket/?id=8311
http://bugs.horde.org/ticket/?id=8399

SektionEins:
http://www.sektioneins.de/advisories/SE-2009-01.txt

Other references
Further details available in Customer Area

Deep Links
Links available in Customer Area