CVE-2013-1904

2014-02-0800:55:00

Debian Security Bug Tracker

security-tracker.debian.org

0.005 Low

EPSS

Percentile

75.1%

JSON

Absolute path traversal vulnerability in steps/mail/sendmail.inc in Roundcube Webmail before 0.7.3 and 0.8.x before 0.8.6 allows remote attackers to read arbitrary files via a full pathname in the _value parameter for the generic_message_footer setting in a save-perf action to index.php, as exploited in the wild in March 2013.

OSVersionArchitecturePackageVersionFilename
Debian12allroundcube< 0.7.2-9roundcube_0.7.2-9_all.deb
Debian11allroundcube< 0.7.2-9roundcube_0.7.2-9_all.deb
Debian10allroundcube< 0.7.2-9roundcube_0.7.2-9_all.deb
Debian999allroundcube< 0.7.2-9roundcube_0.7.2-9_all.deb
Debian13allroundcube< 0.7.2-9roundcube_0.7.2-9_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	12	all	roundcube	< 0.7.2-9	roundcube_0.7.2-9_all.deb
Debian	11	all	roundcube	< 0.7.2-9	roundcube_0.7.2-9_all.deb
Debian	10	all	roundcube	< 0.7.2-9	roundcube_0.7.2-9_all.deb
Debian	999	all	roundcube	< 0.7.2-9	roundcube_0.7.2-9_all.deb
Debian	13	all	roundcube	< 0.7.2-9	roundcube_0.7.2-9_all.deb

0.005 Low

EPSS

Percentile

75.1%

JSON

Related for DEBIANCVE:CVE-2013-1904