[horde] [SECURITY] Horde Groupware 5.2.19 (final)

[Maurício José T. Tecles]

I have two servers wiht Horde Groupware Webmail Edition, one is the  
production server and the other the backup/test server. Yesterday I  
upgraded both to 5.2.19 and notice that they have differences in Pear  
and Pecl packages, Horde packages have the same versions in both  
servers.

PHP version is 5.6.30-0+deb8u1.

Packages marked "<---" have different versions.
The production server have some packages that are not installed in the  
backup/test server (maybe for another reason than Horde, or not).

Listing only the differences:

INSTALLED PACKAGES, CHANNEL PEAR.PHP.NET:
=========================================
======= Production server =============
DB                      1.8.2   stable <---
Date_Holidays_Brazil    0.1.2   alpha
HTML_Common2            2.1.1   stable
HTML_QuickForm2         2.0.2   stable
HTML_QuickForm2_Captcha 0.1.2   alpha
HTTP_Request2           2.2.1   stable
Mail                    1.2.0   stable <---
Math_BigInteger         1.0.2   stable <---
Net_SMTP                1.7.1   stable <---
Net_URL2                2.2.0   stable
PEAR                    1.10.3  stable <---
Services_ReCaptcha      1.0.3   stable
Structures_Graph        1.1.1   stable <---
Text_Password           1.1.1   stable <---
XML_Util                1.4.2   stable <---
======= backup/test server ==========
DB                  1.9.2   stable <---
Mail                1.3.0   stable <---
Math_BigInteger     1.0.3   stable <---
Net_SMTP            1.7.3   stable <---
PEAR                1.9.5   stable <---
Structures_Graph    1.0.4   stable <---
Text_Password       1.2.1   stable <---
XML_Util            1.2.3   stable <---


INSTALLED PACKAGES, CHANNEL PECL.PHP.NET:
=========================================
======= Production server =============
mongodb   1.1.8   stable <---
msgpack   0.5.7   beta
pecl_http 2.5.5   stable
propro    1.0.2   stable
raphf     1.1.2   stable
ssh2      0.12    beta   <---
xdiff     1.4.1   stable
======= backup/test server ==========
mongodb   1.2.5   stable <---
ssh2      0.13    stable <---

The backup/test server where upgraded from Horde Groupware Webmail  
Edition 5.2.18 to 5.2.19.

The production server where upgraded from Horde Groupware Webmail  
Edition 5.2.17 to 5.2.19. From the upgrade process on this server, I  
can see:

downloading ssh2-0.13.tgz ...
Starting to download ssh2-0.13.tgz (28,984 bytes)
...done: 28,984 bytes

and

ERROR: pecl.php.net/ssh2 not installed

Note, as listed above, that it has already installed ssh2 0.12 beta.

Horde Groupware Webmail Edition seems to be working fine on both servers.

Should I force to install ssh2-0.13 (production server)?
Should I force upgrade to the newer versions of the packages listed  
above, on both servers?
What about the packages that are not installed on the backup/test  
server, should I install them?

Mauricio

-- 

Maurício José T. Tecles
Instituto de Biofísica Carlos Chagas Filho/UFRJ
Av. Carlos Chagas Filho, 373
Núcleo de Informática
CCS, Bloco G, sala G1-006
Cidade Universitária - Ilha do Fundão
21941-902, Rio de Janeiro - RJ

mtecles at biof.ufrj.br
Tel.: (21) 3938-6526 ou 3938-6544