CVE-2023-46267

2023-10-2004:15:00

Debian Security Bug Tracker

security-tracker.debian.org

roundcube

xss

svg

image

wash_uri

unix

0.0004 Low

EPSS

Percentile

8.5%

JSON

Roundcube before 1.4.15, 1.5.x before 1.5.5, and 1.6.x before 1.6.4 allows XSS via a text/html e-mail message containing an SVG image with a USE element. This is related to wash_uri in rcube_washtml.php.

OSVersionArchitecturePackageVersionFilename
Debian12allroundcube<= 1.6.3+dfsg-1~deb12u1roundcube_1.6.3+dfsg-1~deb12u1_all.deb
Debian11allroundcube<= 1.4.14+dfsg.1-1~deb11u1roundcube_1.4.14+dfsg.1-1~deb11u1_all.deb
Debian10allroundcube<= 1.3.17+dfsg.1-1~deb10u2roundcube_1.3.17+dfsg.1-1~deb10u2_all.deb
Debian999allroundcube< 1.6.4+dfsg-1roundcube_1.6.4+dfsg-1_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	12	all	roundcube	<= 1.6.3+dfsg-1~deb12u1	roundcube_1.6.3+dfsg-1~deb12u1_all.deb
Debian	11	all	roundcube	<= 1.4.14+dfsg.1-1~deb11u1	roundcube_1.4.14+dfsg.1-1~deb11u1_all.deb
Debian	10	all	roundcube	<= 1.3.17+dfsg.1-1~deb10u2	roundcube_1.3.17+dfsg.1-1~deb10u2_all.deb
Debian	999	all	roundcube	< 1.6.4+dfsg-1	roundcube_1.6.4+dfsg-1_all.deb

0.0004 Low

EPSS

Percentile

8.5%

JSON

Related for DEBIANCVE:CVE-2023-46267