CVE catalog

CVE-2020-13756

php-horde-css-parser: CVE-2020-13756

[CVE catalog]

Severity
Medium
Published
Source
[NVD] · [CVE record]
EPSS
49.80% · Oct 25, 2026

Sabberworm PHP CSS Parser before 8.3.1 calls eval on uncontrolled data, possibly leading to remote code execution if the function allSelectors() or getSelectorsBySpecificity() is called with input from an attacker.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianphp-horde-css-parsersid1.0.11-8.1fixed
Debianphp-horde-css-parserbookworm1.0.11-8vulnerable
Ubuntuphp-horde-css-parserpro1.0.11-1vulnerable
Ubuntuphp-horde-css-parserpro1.0.11-1ubuntu1vulnerable
Ubuntuphp-horde-css-parserpro1.0.11-1ubuntu1+esm1fixed
Ubuntuphp-horde-css-parserpro1.0.11-1vulnerable
Ubuntuphp-horde-css-parserpro1.0.11-1ubuntu1vulnerable
Ubuntuphp-horde-css-parserpro1.0.11-1ubuntu1+esm1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianphp-horde-css-parsersourcesid1.0.11-8.1not yet assignedNot reported[1104702]
Debianphp-horde-css-parsersourcebookworm(unfixed)not yet assignedNot reported[1104702]
Ubuntuphp-horde-css-parserdebpro1.0.11-1ubuntu1+esm1Not reportedUSN-7502-1Not reported
Ubuntuphp-horde-css-parserdebpro1.0.11-1ubuntu1+esm1Not reportedUBUNTU-CVE-2020-13756Not reported

[Debian bug #1104702]

Notes

[bookworm] php-horde-css-parser: Horde is non-functional in Bookworm

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [php-horde-css-parser]Affected
    Details (2)

    • 1.0.11-8 · all · bookworm

      Affected

      dsa · php-horde-css-parser · debian · bookworm; dsa · php-horde-css-parser · debian · 12

    • 1.0.11-8 · all · bookworm

      Affected

      dsa · php-horde-css-parser · debian · bookworm; dsa · php-horde-css-parser · debian · 12

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database]