Debian Roundcube vulnerabilities

CVE-2019-15237 [HIGH] CVE-2019-15237: roundcube - Roundcube Webmail through 1.3.9 mishandles Punycode xn-- domain names, leading t... Roundcube Webmail through 1.3.9 mishandles Punycode xn-- domain names, leading to homograph attacks. Scope: local bookworm: resolved (fixed in 1.5.0+dfsg.1-1) bullseye: open forky: resolved (fixed in 1.5.0+dfsg.1-1) sid: resolved (fixed in 1.5.0+dfsg.1-1) trixie: resolved (fixed in 1.5.0+dfsg.1-1)

CVE-2018-9846 [HIGH] CVE-2018-9846: roundcube - In Roundcube from versions 1.2.0 to 1.3.5, with the archive plugin enabled and c... In Roundcube from versions 1.2.0 to 1.3.5, with the archive plugin enabled and configured, it's possible to exploit the unsanitized, user-controlled "_uid" parameter (in an archive.php _task=mail&_mbox=INBOX&_action=plugin.move2archive request) to perform an MX (IMAP) injection attack by placing an IMAP command after a %0d%0a sequence. NOTE: this is less easily expl

CVE-2018-19205 [MEDIUM] CVE-2018-19205: roundcube - Roundcube before 1.3.7 mishandles GnuPG MDC integrity-protection warnings, which... Roundcube before 1.3.7 mishandles GnuPG MDC integrity-protection warnings, which makes it easier for attackers to obtain sensitive information, a related issue to CVE-2017-17688. This is associated with plugins/enigma/lib/enigma_driver_gnupg.php. Scope: local bookworm: resolved (fixed in 1.3.8+dfsg.1-1) bullseye: resolved (fixed in 1.3.8+dfsg.1-1) forky: resolve

CVE-2018-19206 [MEDIUM] CVE-2018-19206: roundcube - steps/mail/func.inc in Roundcube before 1.3.8 has XSS via crafted use of <svg><s... steps/mail/func.inc in Roundcube before 1.3.8 has XSS via crafted use of , as demonstrated by an onload attribute in a BODY element, within an HTML attachment. Scope: local bookworm: resolved (fixed in 1.3.8+dfsg.1-1) bullseye: resolved (fixed in 1.3.8+dfsg.1-1) forky: resolved (fixed in 1.3.8+dfsg.1-1) sid: resolved (fixed in 1.3.8+dfsg.1-1) trixie: resolved (f

CVE-2018-1000071 [HIGH] CVE-2018-1000071: roundcube - roundcube version 1.3.4 and earlier contains an Insecure Permissions vulnerabili... roundcube version 1.3.4 and earlier contains an Insecure Permissions vulnerability in enigma plugin that can result in exfiltration of gpg private key. This attack appear to be exploitable via network connectivity. Scope: local bookworm: resolved (fixed in 1.3.10+dfsg.1-1) bullseye: resolved (fixed in 1.3.10+dfsg.1-1) forky: resolved (fixed in 1.3.10+dfsg.1-1)

CVE-2017-16651 [HIGH] CVE-2017-16651: roundcube - Roundcube Webmail before 1.1.10, 1.2.x before 1.2.7, and 1.3.x before 1.3.3 allo... Roundcube Webmail before 1.1.10, 1.2.x before 1.2.7, and 1.3.x before 1.3.3 allows unauthorized access to arbitrary files on the host's filesystem, including configuration files, as exploited in the wild in November 2017. The attacker must be able to authenticate at the target system with a valid username/password as the attack requires an active session. The issu

CVE-2017-8114 [HIGH] CVE-2017-8114: roundcube - Roundcube Webmail allows arbitrary password resets by authenticated users. This ... Roundcube Webmail allows arbitrary password resets by authenticated users. This affects versions before 1.0.11, 1.1.x before 1.1.9, and 1.2.x before 1.2.5. The problem is caused by an improperly restricted exec call in the virtualmin and sasl drivers of the password plugin. Scope: local bookworm: resolved (fixed in 1.2.3+dfsg.1-4) bullseye: resolved (fixed in 1.2.3+

CVE-2017-6820 [MEDIUM] CVE-2017-6820: roundcube - rcube_utils.php in Roundcube before 1.1.8 and 1.2.x before 1.2.4 is susceptible ... rcube_utils.php in Roundcube before 1.1.8 and 1.2.x before 1.2.4 is susceptible to a cross-site scripting vulnerability via a crafted Cascading Style Sheets (CSS) token sequence within an SVG element. Scope: local bookworm: resolved (fixed in 1.2.3+dfsg.1-3) bullseye: resolved (fixed in 1.2.3+dfsg.1-3) forky: resolved (fixed in 1.2.3+dfsg.1-3) sid: resolved (fixed

CVE-2016-4069 [HIGH] CVE-2016-4069: roundcube - Cross-site request forgery (CSRF) vulnerability in Roundcube Webmail before 1.1.... Cross-site request forgery (CSRF) vulnerability in Roundcube Webmail before 1.1.5 allows remote attackers to hijack the authentication of users for requests that download attachments and cause a denial of service (disk consumption) via unspecified vectors. Scope: local bookworm: resolved (fixed in 1.1.5+dfsg.1-1) bullseye: resolved (fixed in 1.1.5+dfsg.1-1) forky: r

CVE-2016-9920 [HIGH] CVE-2016-9920: roundcube - steps/mail/sendmail.inc in Roundcube before 1.1.7 and 1.2.x before 1.2.3, when n... steps/mail/sendmail.inc in Roundcube before 1.1.7 and 1.2.x before 1.2.3, when no SMTP server is configured and the sendmail program is enabled, does not properly restrict the use of custom envelope-from addresses on the sendmail command line, which allows remote authenticated users to execute arbitrary code via a modified HTTP request that sends a crafted e-mail me

CVE-2016-4068 [MEDIUM] CVE-2016-4068: roundcube - Cross-site scripting (XSS) vulnerability in Roundcube Webmail before 1.0.9 and 1... Cross-site scripting (XSS) vulnerability in Roundcube Webmail before 1.0.9 and 1.1.x before 1.1.5 allows remote attackers to inject arbitrary web script or HTML via a crafted SVG, a different vulnerability than CVE-2015-8864. Scope: local bookworm: resolved (fixed in 1.2.1+dfsg.1-1) bullseye: resolved (fixed in 1.2.1+dfsg.1-1) forky: resolved (fixed in 1.2.1+dfsg.

CVE-2016-4552 [MEDIUM] CVE-2016-4552: roundcube - Cross-site scripting (XSS) vulnerability in Roundcube Webmail before 1.2.0 allow... Cross-site scripting (XSS) vulnerability in Roundcube Webmail before 1.2.0 allows remote attackers to inject arbitrary web script or HTML via the href attribute in an area tag in an e-mail message. Scope: local bookworm: resolved (fixed in 1.2.0+dfsg.1-1) bullseye: resolved (fixed in 1.2.0+dfsg.1-1) forky: resolved (fixed in 1.2.0+dfsg.1-1) sid: resolved (fixed in

CVE-2015-2181 [HIGH] CVE-2015-2181: roundcube - Multiple buffer overflows in the DBMail driver in the Password plugin in Roundcu... Multiple buffer overflows in the DBMail driver in the Password plugin in Roundcube before 1.1.0 allow remote attackers to have unspecified impact via the (1) password or (2) username. Scope: local bookworm: resolved (fixed in 1.1.1+dfsg.1-2) bullseye: resolved (fixed in 1.1.1+dfsg.1-2) forky: resolved (fixed in 1.1.1+dfsg.1-2) sid: resolved (fixed in 1.1.1+dfsg.1-2)

CVE-2015-2180 [HIGH] CVE-2015-2180: roundcube - The DBMail driver in the Password plugin in Roundcube before 1.1.0 allows remote... The DBMail driver in the Password plugin in Roundcube before 1.1.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the password. Scope: local bookworm: resolved (fixed in 1.1.1+dfsg.1-2) bullseye: resolved (fixed in 1.1.1+dfsg.1-2) forky: resolved (fixed in 1.1.1+dfsg.1-2) sid: resolved (fixed in 1.1.1+dfsg.1-2) trixie: resolved (fi

CVE-2015-8770 [HIGH] CVE-2015-8770: roundcube - Directory traversal vulnerability in the set_skin function in program/include/rc... Directory traversal vulnerability in the set_skin function in program/include/rcmail_output_html.php in Roundcube before 1.0.8 and 1.1.x before 1.1.4 allows remote authenticated users with certain permissions to read arbitrary files or possibly execute arbitrary code via a .. (dot dot) in the _skin parameter to index.php. Scope: local bookworm: resolved (fixed in 1.

CVE-2015-8793 [MEDIUM] CVE-2015-8793: roundcube - Cross-site scripting (XSS) vulnerability in program/include/rcmail.php in Roundc... Cross-site scripting (XSS) vulnerability in program/include/rcmail.php in Roundcube before 1.0.6 and 1.1.x before 1.1.2 allows remote attackers to inject arbitrary web script or HTML via the _mbox parameter in a mail task to the default URL, a different vulnerability than CVE-2011-2937. Scope: local bookworm: resolved (fixed in 1.1.2+dfsg.1-1) bullseye: resolved (

CVE-2015-8794 [MEDIUM] CVE-2015-8794: roundcube - Absolute path traversal vulnerability in program/steps/addressbook/photo.inc in ... Absolute path traversal vulnerability in program/steps/addressbook/photo.inc in Roundcube before 1.0.6 and 1.1.x before 1.1.2 allows remote authenticated users to read arbitrary files via a full pathname in the _alt parameter, related to contact photo handling. Scope: local bookworm: resolved (fixed in 1.1.2+dfsg.1-1) bullseye: resolved (fixed in 1.1.2+dfsg.1-1) f

CVE-2015-8864 [MEDIUM] CVE-2015-8864: roundcube - Cross-site scripting (XSS) vulnerability in Roundcube Webmail before 1.0.9 and 1... Cross-site scripting (XSS) vulnerability in Roundcube Webmail before 1.0.9 and 1.1.x before 1.1.5 allows remote attackers to inject arbitrary web script or HTML via a crafted SVG, a different vulnerability than CVE-2016-4068. Scope: local bookworm: resolved (fixed in 1.1.5+dfsg.1-1) bullseye: resolved (fixed in 1.1.5+dfsg.1-1) forky: resolved (fixed in 1.1.5+dfsg.

CVE-2015-5381 [MEDIUM] CVE-2015-5381: roundcube - Cross-site scripting (XSS) vulnerability in program/include/rcmail.php in Roundc... Cross-site scripting (XSS) vulnerability in program/include/rcmail.php in Roundcube Webmail 1.1.x before 1.1.2 allows remote attackers to inject arbitrary web script or HTML via the _mbox parameter to the default URI. Scope: local bookworm: resolved (fixed in 1.1.2+dfsg.1-1) bullseye: resolved (fixed in 1.1.2+dfsg.1-1) forky: resolved (fixed in 1.1.2+dfsg.1-1) sid

CVE-2015-5382 [MEDIUM] CVE-2015-5382: roundcube - program/steps/addressbook/photo.inc in Roundcube Webmail before 1.0.6 and 1.1.x ... program/steps/addressbook/photo.inc in Roundcube Webmail before 1.0.6 and 1.1.x before 1.1.2 allows remote authenticated users to read arbitrary files via the _alt parameter when uploading a vCard. Scope: local bookworm: resolved (fixed in 1.1.2+dfsg.1-1) bullseye: resolved (fixed in 1.1.2+dfsg.1-1) forky: resolved (fixed in 1.1.2+dfsg.1-1) sid: resolved (fixed in