ID FEDORA_2015-11405.NASL Type nessus Reporter This script is Copyright (C) 2015-2018 Tenable Network Security, Inc. Modified 2019-11-02T00:00:00
Description
Release 1.1.2
Add new plugin hook
#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Fedora Security Advisory 2015-11405.
#
include("compat.inc");
if (description)
{
script_id(85058);
script_version("$Revision: 2.4 $");
script_cvs_date("$Date: 2018/01/30 17:46:07 $");
script_cve_id("CVE-2015-5381", "CVE-2015-5382", "CVE-2015-5383");
script_xref(name:"FEDORA", value:"2015-11405");
script_name(english:"Fedora 22 : roundcubemail-1.1.2-1.fc22 (2015-11405)");
script_summary(english:"Checks rpm output for the updated package.");
script_set_attribute(
attribute:"synopsis",
value:"The remote Fedora host is missing a security update."
);
script_set_attribute(
attribute:"description",
value:
"**Release 1.1.2**
- Add new plugin hook 'identity_create_after' providing
the ID of the inserted identity (#1490358)
- Add option to place signature at bottom of the quoted
text even in top-posting mode [sig_below]
- Fix handling of %-encoded entities in mailto: URLs
(#1490346)
- Fix zipped messages downloads after selecting all
messages in a folder (#1490339)
- Fix vpopmaild driver of password plugin
- Fix PHP warning: Non-static method
PEAR::setErrorHandling() should not be called
statically (#1490343)
- Fix tables listing routine on mysql and postgres so it
skips system or other database tables and views
(#1490337)
- Fix message list header in classic skin on window
resize in Internet Explorer (#1490213)
- Fix so text/calendar parts are listed as attachments
even if not marked as such (#1490325)
- Fix lack of signature separator for plain text
signatures in html mode (#1490352)
- Fix font artifact in Google Chrome on Windows
(#1490353)
- Fix bug where forced extwin page reload could exit
from the extwin mode (#1490350)
- Fix bug where some unrelated attachments in
multipart/related message were not listed (#1490355)
- Fix mouseup event handling when dragging a list record
(#1490359)
- Fix bug where preview_pane setting wasn't always saved
into user preferences (#1490362)
- Fix bug where messages count was not updated after
message move/delete with skip_deleted=false (#1490372)
- Fix security issue in contact photo handling
(#1490379)
- Fix possible memcache/apc cache data consistency
issues (#1490390)
- Fix bug where imap_conn_options were ignored in IMAP
connection test (#1490392)
- Fix bug where some files could have 'executable'
extension when stored in temp folder (#1490377)
- Fix attached file path unsetting in
database_attachments plugin (#1490393)
- Fix issues when using moduserprefs.sh without --user
argument (#1490399)
- Fix potential info disclosure issue by protecting
directory access (#1490378)
- Fix blank image in html_signature when saving identity
changes (#1490412)
- Installer: Use openssl_random_pseudo_bytes() (if
available) to generate des_key (#1490402)
- Fix XSS vulnerability in _mbox argument handling
(#1490417)
Note that Tenable Network Security has extracted the preceding
description block directly from the Fedora security advisory. Tenable
has attempted to automatically clean and format it as much as possible
without introducing additional issues."
);
script_set_attribute(
attribute:"see_also",
value:"https://bugzilla.redhat.com/show_bug.cgi?id=1241056"
);
# https://lists.fedoraproject.org/pipermail/package-announce/2015-July/162461.html
script_set_attribute(
attribute:"see_also",
value:"http://www.nessus.org/u?f0e6d6b0"
);
script_set_attribute(
attribute:"solution",
value:"Update the affected roundcubemail package."
);
script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N");
script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N");
script_set_attribute(attribute:"plugin_type", value:"local");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fedoraproject:fedora:roundcubemail");
script_set_attribute(attribute:"cpe", value:"cpe:/o:fedoraproject:fedora:22");
script_set_attribute(attribute:"patch_publication_date", value:"2015/07/13");
script_set_attribute(attribute:"plugin_publication_date", value:"2015/07/29");
script_end_attributes();
script_category(ACT_GATHER_INFO);
script_copyright(english:"This script is Copyright (C) 2015-2018 Tenable Network Security, Inc.");
script_family(english:"Fedora Local Security Checks");
script_dependencies("ssh_get_info.nasl");
script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list");
exit(0);
}
include("audit.inc");
include("global_settings.inc");
include("rpm.inc");
if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
release = get_kb_item("Host/RedHat/release");
if (isnull(release) || "Fedora" >!< release) audit(AUDIT_OS_NOT, "Fedora");
os_ver = eregmatch(pattern: "Fedora.*release ([0-9]+)", string:release);
if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Fedora");
os_ver = os_ver[1];
if (! ereg(pattern:"^22([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Fedora 22.x", "Fedora " + os_ver);
if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Fedora", cpu);
flag = 0;
if (rpm_check(release:"FC22", reference:"roundcubemail-1.1.2-1.fc22")) flag++;
if (flag)
{
if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());
else security_warning(0);
exit(0);
}
else
{
tested = pkg_tests_get();
if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
else audit(AUDIT_PACKAGE_NOT_INSTALLED, "roundcubemail");
}
{"id": "FEDORA_2015-11405.NASL", "bulletinFamily": "scanner", "title": "Fedora 22 : roundcubemail-1.1.2-1.fc22 (2015-11405)", "description": "**Release 1.1.2**\n\n - Add new plugin hook ", "published": "2015-07-29T00:00:00", "modified": "2019-11-02T00:00:00", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N"}, "href": "https://www.tenable.com/plugins/nessus/85058", "reporter": "This script is Copyright (C) 2015-2018 Tenable Network Security, Inc.", "references": ["http://www.nessus.org/u?f0e6d6b0", "https://bugzilla.redhat.com/show_bug.cgi?id=1241056"], "cvelist": ["CVE-2015-5381", "CVE-2015-5383", "CVE-2015-5382"], "type": "nessus", "lastseen": "2019-11-01T02:27:19", "history": [{"bulletin": {"bulletinFamily": "scanner", "cpe": ["p-cpe:/a:fedoraproject:fedora:roundcubemail", "cpe:/o:fedoraproject:fedora:22"], "cvelist": ["CVE-2015-5381", "CVE-2015-5383", "CVE-2015-5382"], "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N"}, "description": "**Release 1.1.2**\n\n - Add new plugin hook ", "edition": 10, "enchantments": {"dependencies": {"modified": "2019-10-28T20:11:41", "references": [{"idList": ["CVE-2015-5381", "CVE-2015-5383", "CVE-2015-5382"], "type": "cve"}, {"idList": ["038A5808-24B3-11E5-B0C8-BF4D8935D4FA"], "type": "freebsd"}, {"idList": ["OPENVAS:1361412562310131093", "OPENVAS:1361412562310869812", "OPENVAS:1361412562310108170", "OPENVAS:1361412562310869808"], "type": "openvas"}, {"idList": ["FREEBSD_PKG_038A580824B311E5B0C8BF4D8935D4FA.NASL", "FEDORA_2015-11469.NASL"], "type": "nessus"}]}, "score": {"modified": "2019-10-28T20:11:41", "value": 6.4, "vector": "NONE"}}, "hash": "9e8bacc86acb55f8beeb7917f735f9c25423cffbf0d1a7b69afd951ad0c364a8", "hashmap": [{"hash": "109be886b34e1faf954efee8d1f4fe78", "key": "title"}, {"hash": "e94dae84fac5b8517c1cea71aefc4971", "key": "cvelist"}, {"hash": "3b6bf49702d7579a55b7e6f3efb3fc26", "key": "pluginID"}, {"hash": "83d85f0b2082533b5c390c185dd3e8ce", "key": "reporter"}, {"hash": "8b12d0b56a577712a6cf4fbc35538269", "key": "published"}, {"hash": "e95b7aa23e6110a09a0594f094d21edc", "key": "references"}, {"hash": "6b5911fa28bb46e51ed4f93e7f98d4a5", "key": "href"}, {"hash": "25701220924168a390e5fa01fd26eb37", "key": "cpe"}, {"hash": "a89198c45ce87f7ec9735a085150b708", "key": "cvss"}, {"hash": "a748f05daf7beef7be570582018c1404", "key": "sourceData"}, {"hash": "bbdaea376f500d25f6b0c1050311dd07", "key": "bulletinFamily"}, {"hash": "5e0bd03bec244039678f2b955a2595aa", "key": "type"}, {"hash": "0bafb6325bcaf483a25404f785191cc5", "key": "modified"}, {"hash": "be931514784f88df80712740ad2723e7", "key": "naslFamily"}, {"hash": "e4dd13f12799503bd80328274a3a1c82", "key": "description"}], "history": [], "href": "https://www.tenable.com/plugins/nessus/85058", "id": "FEDORA_2015-11405.NASL", "lastseen": "2019-10-28T20:11:41", "modified": "2019-10-02T00:00:00", "naslFamily": "Fedora Local Security Checks", "objectVersion": "1.3", "pluginID": "85058", "published": "2015-07-29T00:00:00", "references": ["http://www.nessus.org/u?f0e6d6b0", "https://bugzilla.redhat.com/show_bug.cgi?id=1241056"], "reporter": "This script is Copyright (C) 2015-2018 Tenable Network Security, Inc.", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Fedora Security Advisory 2015-11405.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(85058);\n script_version(\"$Revision: 2.4 $\");\n script_cvs_date(\"$Date: 2018/01/30 17:46:07 $\");\n\n script_cve_id(\"CVE-2015-5381\", \"CVE-2015-5382\", \"CVE-2015-5383\");\n script_xref(name:\"FEDORA\", value:\"2015-11405\");\n\n script_name(english:\"Fedora 22 : roundcubemail-1.1.2-1.fc22 (2015-11405)\");\n script_summary(english:\"Checks rpm output for the updated package.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Fedora host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"**Release 1.1.2**\n\n - Add new plugin hook 'identity_create_after' providing\n the ID of the inserted identity (#1490358)\n\n - Add option to place signature at bottom of the quoted\n text even in top-posting mode [sig_below]\n\n - Fix handling of %-encoded entities in mailto: URLs\n (#1490346)\n\n - Fix zipped messages downloads after selecting all\n messages in a folder (#1490339)\n\n - Fix vpopmaild driver of password plugin\n\n - Fix PHP warning: Non-static method\n PEAR::setErrorHandling() should not be called\n statically (#1490343)\n\n - Fix tables listing routine on mysql and postgres so it\n skips system or other database tables and views\n (#1490337)\n\n - Fix message list header in classic skin on window\n resize in Internet Explorer (#1490213)\n\n - Fix so text/calendar parts are listed as attachments\n even if not marked as such (#1490325)\n\n - Fix lack of signature separator for plain text\n signatures in html mode (#1490352)\n\n - Fix font artifact in Google Chrome on Windows\n (#1490353)\n\n - Fix bug where forced extwin page reload could exit\n from the extwin mode (#1490350)\n\n - Fix bug where some unrelated attachments in\n multipart/related message were not listed (#1490355)\n\n - Fix mouseup event handling when dragging a list record\n (#1490359)\n\n - Fix bug where preview_pane setting wasn't always saved\n into user preferences (#1490362)\n\n - Fix bug where messages count was not updated after\n message move/delete with skip_deleted=false (#1490372)\n\n - Fix security issue in contact photo handling\n (#1490379)\n\n - Fix possible memcache/apc cache data consistency\n issues (#1490390)\n\n - Fix bug where imap_conn_options were ignored in IMAP\n connection test (#1490392)\n\n - Fix bug where some files could have 'executable'\n extension when stored in temp folder (#1490377)\n\n - Fix attached file path unsetting in\n database_attachments plugin (#1490393)\n\n - Fix issues when using moduserprefs.sh without --user\n argument (#1490399)\n\n - Fix potential info disclosure issue by protecting\n directory access (#1490378)\n\n - Fix blank image in html_signature when saving identity\n changes (#1490412)\n\n - Installer: Use openssl_random_pseudo_bytes() (if\n available) to generate des_key (#1490402)\n\n - Fix XSS vulnerability in _mbox argument handling\n (#1490417)\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.redhat.com/show_bug.cgi?id=1241056\"\n );\n # https://lists.fedoraproject.org/pipermail/package-announce/2015-July/162461.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?f0e6d6b0\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected roundcubemail package.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:roundcubemail\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:fedoraproject:fedora:22\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2015/07/13\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2015/07/29\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2015-2018 Tenable Network Security, Inc.\");\n script_family(english:\"Fedora Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Fedora\" >!< release) audit(AUDIT_OS_NOT, \"Fedora\");\nos_ver = eregmatch(pattern: \"Fedora.*release ([0-9]+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Fedora\");\nos_ver = os_ver[1];\nif (! ereg(pattern:\"^22([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Fedora 22.x\", \"Fedora \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Fedora\", cpu);\n\nflag = 0;\nif (rpm_check(release:\"FC22\", reference:\"roundcubemail-1.1.2-1.fc22\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());\n else security_warning(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"roundcubemail\");\n}\n", "title": "Fedora 22 : roundcubemail-1.1.2-1.fc22 (2015-11405)", "type": "nessus", "viewCount": 0}, "differentElements": ["modified"], "edition": 10, "lastseen": "2019-10-28T20:11:41"}, {"bulletin": {"bulletinFamily": "scanner", "cpe": ["p-cpe:/a:fedoraproject:fedora:roundcubemail", "cpe:/o:fedoraproject:fedora:22"], "cvelist": ["CVE-2015-5381", "CVE-2015-5383", "CVE-2015-5382"], "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:NONE/A:NONE/"}, "description": "**Release 1.1.2**\n\n - Add new plugin hook 'identity_create_after' providing the ID of the inserted identity (#1490358)\n\n - Add option to place signature at bottom of the quoted text even in top-posting mode [sig_below]\n\n - Fix handling of %-encoded entities in mailto: URLs (#1490346)\n\n - Fix zipped messages downloads after selecting all messages in a folder (#1490339)\n\n - Fix vpopmaild driver of password plugin\n\n - Fix PHP warning: Non-static method PEAR::setErrorHandling() should not be called statically (#1490343)\n\n - Fix tables listing routine on mysql and postgres so it skips system or other database tables and views (#1490337)\n\n - Fix message list header in classic skin on window resize in Internet Explorer (#1490213)\n\n - Fix so text/calendar parts are listed as attachments even if not marked as such (#1490325)\n\n - Fix lack of signature separator for plain text signatures in html mode (#1490352)\n\n - Fix font artifact in Google Chrome on Windows (#1490353)\n\n - Fix bug where forced extwin page reload could exit from the extwin mode (#1490350)\n\n - Fix bug where some unrelated attachments in multipart/related message were not listed (#1490355)\n\n - Fix mouseup event handling when dragging a list record (#1490359)\n\n - Fix bug where preview_pane setting wasn't always saved into user preferences (#1490362)\n\n - Fix bug where messages count was not updated after message move/delete with skip_deleted=false (#1490372)\n\n - Fix security issue in contact photo handling (#1490379)\n\n - Fix possible memcache/apc cache data consistency issues (#1490390)\n\n - Fix bug where imap_conn_options were ignored in IMAP connection test (#1490392)\n\n - Fix bug where some files could have 'executable' extension when stored in temp folder (#1490377)\n\n - Fix attached file path unsetting in database_attachments plugin (#1490393)\n\n - Fix issues when using moduserprefs.sh without --user argument (#1490399)\n\n - Fix potential info disclosure issue by protecting directory access (#1490378)\n\n - Fix blank image in html_signature when saving identity changes (#1490412)\n\n - Installer: Use openssl_random_pseudo_bytes() (if available) to generate des_key (#1490402)\n\n - Fix XSS vulnerability in _mbox argument handling (#1490417)\n\nNote that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "edition": 9, "enchantments": {"dependencies": {"modified": "2019-02-21T01:24:44", "references": [{"idList": ["CVE-2015-5381", "CVE-2015-5383", "CVE-2015-5382"], "type": "cve"}, {"idList": ["038A5808-24B3-11E5-B0C8-BF4D8935D4FA"], "type": "freebsd"}, {"idList": ["OPENVAS:1361412562310131093", "OPENVAS:1361412562310869812", "OPENVAS:1361412562310108170", "OPENVAS:1361412562310869808"], "type": "openvas"}, {"idList": ["FREEBSD_PKG_038A580824B311E5B0C8BF4D8935D4FA.NASL", "FEDORA_2015-11469.NASL"], "type": "nessus"}]}, "score": {"modified": "2019-02-21T01:24:44", "value": 4.9, "vector": "NONE"}}, "hash": "52104626630abc798e6e68822e45cc2e4d719af882dd0b4f277281bed9eca489", "hashmap": [{"hash": "109be886b34e1faf954efee8d1f4fe78", "key": "title"}, {"hash": "e94dae84fac5b8517c1cea71aefc4971", "key": "cvelist"}, {"hash": "3b6bf49702d7579a55b7e6f3efb3fc26", "key": "pluginID"}, {"hash": "8b12d0b56a577712a6cf4fbc35538269", "key": "published"}, {"hash": "e95b7aa23e6110a09a0594f094d21edc", "key": "references"}, {"hash": "9cf00d658b687f030ebe173a0528c567", "key": "reporter"}, {"hash": "f53d84b9efaf4517b420dd2e3a4f1f3f", "key": "modified"}, {"hash": "25701220924168a390e5fa01fd26eb37", "key": "cpe"}, {"hash": "a748f05daf7beef7be570582018c1404", "key": "sourceData"}, {"hash": "a792e2393dff1e200b885c5245988f6f", "key": "cvss"}, {"hash": "bbdaea376f500d25f6b0c1050311dd07", "key": "bulletinFamily"}, {"hash": "5e0bd03bec244039678f2b955a2595aa", "key": "type"}, {"hash": "34dfbbf45410802bb1338384300dc474", "key": "description"}, {"hash": "be931514784f88df80712740ad2723e7", "key": "naslFamily"}, {"hash": "5a3c8da19f5ce4a556d617a1691c81a0", "key": "href"}], "history": [], "href": "https://www.tenable.com/plugins/index.php?view=single&id=85058", "id": "FEDORA_2015-11405.NASL", "lastseen": "2019-02-21T01:24:44", "modified": "2018-01-30T00:00:00", "naslFamily": "Fedora Local Security Checks", "objectVersion": "1.3", "pluginID": "85058", "published": "2015-07-29T00:00:00", "references": ["http://www.nessus.org/u?f0e6d6b0", "https://bugzilla.redhat.com/show_bug.cgi?id=1241056"], "reporter": "Tenable", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Fedora Security Advisory 2015-11405.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(85058);\n script_version(\"$Revision: 2.4 $\");\n script_cvs_date(\"$Date: 2018/01/30 17:46:07 $\");\n\n script_cve_id(\"CVE-2015-5381\", \"CVE-2015-5382\", \"CVE-2015-5383\");\n script_xref(name:\"FEDORA\", value:\"2015-11405\");\n\n script_name(english:\"Fedora 22 : roundcubemail-1.1.2-1.fc22 (2015-11405)\");\n script_summary(english:\"Checks rpm output for the updated package.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Fedora host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"**Release 1.1.2**\n\n - Add new plugin hook 'identity_create_after' providing\n the ID of the inserted identity (#1490358)\n\n - Add option to place signature at bottom of the quoted\n text even in top-posting mode [sig_below]\n\n - Fix handling of %-encoded entities in mailto: URLs\n (#1490346)\n\n - Fix zipped messages downloads after selecting all\n messages in a folder (#1490339)\n\n - Fix vpopmaild driver of password plugin\n\n - Fix PHP warning: Non-static method\n PEAR::setErrorHandling() should not be called\n statically (#1490343)\n\n - Fix tables listing routine on mysql and postgres so it\n skips system or other database tables and views\n (#1490337)\n\n - Fix message list header in classic skin on window\n resize in Internet Explorer (#1490213)\n\n - Fix so text/calendar parts are listed as attachments\n even if not marked as such (#1490325)\n\n - Fix lack of signature separator for plain text\n signatures in html mode (#1490352)\n\n - Fix font artifact in Google Chrome on Windows\n (#1490353)\n\n - Fix bug where forced extwin page reload could exit\n from the extwin mode (#1490350)\n\n - Fix bug where some unrelated attachments in\n multipart/related message were not listed (#1490355)\n\n - Fix mouseup event handling when dragging a list record\n (#1490359)\n\n - Fix bug where preview_pane setting wasn't always saved\n into user preferences (#1490362)\n\n - Fix bug where messages count was not updated after\n message move/delete with skip_deleted=false (#1490372)\n\n - Fix security issue in contact photo handling\n (#1490379)\n\n - Fix possible memcache/apc cache data consistency\n issues (#1490390)\n\n - Fix bug where imap_conn_options were ignored in IMAP\n connection test (#1490392)\n\n - Fix bug where some files could have 'executable'\n extension when stored in temp folder (#1490377)\n\n - Fix attached file path unsetting in\n database_attachments plugin (#1490393)\n\n - Fix issues when using moduserprefs.sh without --user\n argument (#1490399)\n\n - Fix potential info disclosure issue by protecting\n directory access (#1490378)\n\n - Fix blank image in html_signature when saving identity\n changes (#1490412)\n\n - Installer: Use openssl_random_pseudo_bytes() (if\n available) to generate des_key (#1490402)\n\n - Fix XSS vulnerability in _mbox argument handling\n (#1490417)\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.redhat.com/show_bug.cgi?id=1241056\"\n );\n # https://lists.fedoraproject.org/pipermail/package-announce/2015-July/162461.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?f0e6d6b0\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected roundcubemail package.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:roundcubemail\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:fedoraproject:fedora:22\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2015/07/13\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2015/07/29\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2015-2018 Tenable Network Security, Inc.\");\n script_family(english:\"Fedora Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Fedora\" >!< release) audit(AUDIT_OS_NOT, \"Fedora\");\nos_ver = eregmatch(pattern: \"Fedora.*release ([0-9]+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Fedora\");\nos_ver = os_ver[1];\nif (! ereg(pattern:\"^22([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Fedora 22.x\", \"Fedora \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Fedora\", cpu);\n\nflag = 0;\nif (rpm_check(release:\"FC22\", reference:\"roundcubemail-1.1.2-1.fc22\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());\n else security_warning(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"roundcubemail\");\n}\n", "title": "Fedora 22 : roundcubemail-1.1.2-1.fc22 (2015-11405)", "type": "nessus", "viewCount": 0}, "differentElements": ["cvss", "description", "reporter", "modified", "href"], "edition": 9, "lastseen": "2019-02-21T01:24:44"}, {"bulletin": {"bulletinFamily": "scanner", "cpe": ["p-cpe:/a:fedoraproject:fedora:roundcubemail", "cpe:/o:fedoraproject:fedora:22"], "cvelist": ["CVE-2015-5381", "CVE-2015-5383", "CVE-2015-5382"], "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:NONE/A:NONE/"}, "description": "**Release 1.1.2**\n\n - Add new plugin hook 'identity_create_after' providing the ID of the inserted identity (#1490358)\n\n - Add option to place signature at bottom of the quoted text even in top-posting mode [sig_below]\n\n - Fix handling of %-encoded entities in mailto: URLs (#1490346)\n\n - Fix zipped messages downloads after selecting all messages in a folder (#1490339)\n\n - Fix vpopmaild driver of password plugin\n\n - Fix PHP warning: Non-static method PEAR::setErrorHandling() should not be called statically (#1490343)\n\n - Fix tables listing routine on mysql and postgres so it skips system or other database tables and views (#1490337)\n\n - Fix message list header in classic skin on window resize in Internet Explorer (#1490213)\n\n - Fix so text/calendar parts are listed as attachments even if not marked as such (#1490325)\n\n - Fix lack of signature separator for plain text signatures in html mode (#1490352)\n\n - Fix font artifact in Google Chrome on Windows (#1490353)\n\n - Fix bug where forced extwin page reload could exit from the extwin mode (#1490350)\n\n - Fix bug where some unrelated attachments in multipart/related message were not listed (#1490355)\n\n - Fix mouseup event handling when dragging a list record (#1490359)\n\n - Fix bug where preview_pane setting wasn't always saved into user preferences (#1490362)\n\n - Fix bug where messages count was not updated after message move/delete with skip_deleted=false (#1490372)\n\n - Fix security issue in contact photo handling (#1490379)\n\n - Fix possible memcache/apc cache data consistency issues (#1490390)\n\n - Fix bug where imap_conn_options were ignored in IMAP connection test (#1490392)\n\n - Fix bug where some files could have 'executable' extension when stored in temp folder (#1490377)\n\n - Fix attached file path unsetting in database_attachments plugin (#1490393)\n\n - Fix issues when using moduserprefs.sh without --user argument (#1490399)\n\n - Fix potential info disclosure issue by protecting directory access (#1490378)\n\n - Fix blank image in html_signature when saving identity changes (#1490412)\n\n - Installer: Use openssl_random_pseudo_bytes() (if available) to generate des_key (#1490402)\n\n - Fix XSS vulnerability in _mbox argument handling (#1490417)\n\nNote that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "edition": 4, "enchantments": {"score": {"modified": "2017-10-29T13:40:05", "value": 3.3}}, "hash": "b4cc6a59526a868c4e842d206d73f5cc80df1b8432447bc70fd6ce836d1c8d55", "hashmap": [{"hash": "109be886b34e1faf954efee8d1f4fe78", "key": "title"}, {"hash": "e94dae84fac5b8517c1cea71aefc4971", "key": "cvelist"}, {"hash": "3b6bf49702d7579a55b7e6f3efb3fc26", "key": "pluginID"}, {"hash": "8b12d0b56a577712a6cf4fbc35538269", "key": "published"}, {"hash": "e95b7aa23e6110a09a0594f094d21edc", "key": "references"}, {"hash": "9cf00d658b687f030ebe173a0528c567", "key": "reporter"}, {"hash": "25701220924168a390e5fa01fd26eb37", "key": "cpe"}, {"hash": "a792e2393dff1e200b885c5245988f6f", "key": "cvss"}, {"hash": "b5d669e92f0a0584b38169c3be633711", "key": "modified"}, {"hash": "bbdaea376f500d25f6b0c1050311dd07", "key": "bulletinFamily"}, {"hash": "5e0bd03bec244039678f2b955a2595aa", "key": "type"}, {"hash": "34dfbbf45410802bb1338384300dc474", "key": "description"}, {"hash": "be931514784f88df80712740ad2723e7", "key": "naslFamily"}, {"hash": "5a3c8da19f5ce4a556d617a1691c81a0", "key": "href"}, {"hash": "cecd59c8c2a0c94d1a02fe99964e53b4", "key": "sourceData"}], "history": [], "href": "https://www.tenable.com/plugins/index.php?view=single&id=85058", "id": "FEDORA_2015-11405.NASL", "lastseen": "2017-10-29T13:40:05", "modified": "2017-06-05T00:00:00", "naslFamily": "Fedora Local Security Checks", "objectVersion": "1.3", "pluginID": "85058", "published": "2015-07-29T00:00:00", "references": ["http://www.nessus.org/u?f0e6d6b0", "https://bugzilla.redhat.com/show_bug.cgi?id=1241056"], "reporter": "Tenable", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Fedora Security Advisory 2015-11405.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(85058);\n script_version(\"$Revision: 2.3 $\");\n script_cvs_date(\"$Date: 2017/06/05 16:07:23 $\");\n\n script_cve_id(\"CVE-2015-5381\", \"CVE-2015-5382\", \"CVE-2015-5383\");\n script_xref(name:\"FEDORA\", value:\"2015-11405\");\n\n script_name(english:\"Fedora 22 : roundcubemail-1.1.2-1.fc22 (2015-11405)\");\n script_summary(english:\"Checks rpm output for the updated package.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Fedora host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"**Release 1.1.2**\n\n - Add new plugin hook 'identity_create_after' providing\n the ID of the inserted identity (#1490358)\n\n - Add option to place signature at bottom of the quoted\n text even in top-posting mode [sig_below]\n\n - Fix handling of %-encoded entities in mailto: URLs\n (#1490346)\n\n - Fix zipped messages downloads after selecting all\n messages in a folder (#1490339)\n\n - Fix vpopmaild driver of password plugin\n\n - Fix PHP warning: Non-static method\n PEAR::setErrorHandling() should not be called\n statically (#1490343)\n\n - Fix tables listing routine on mysql and postgres so it\n skips system or other database tables and views\n (#1490337)\n\n - Fix message list header in classic skin on window\n resize in Internet Explorer (#1490213)\n\n - Fix so text/calendar parts are listed as attachments\n even if not marked as such (#1490325)\n\n - Fix lack of signature separator for plain text\n signatures in html mode (#1490352)\n\n - Fix font artifact in Google Chrome on Windows\n (#1490353)\n\n - Fix bug where forced extwin page reload could exit\n from the extwin mode (#1490350)\n\n - Fix bug where some unrelated attachments in\n multipart/related message were not listed (#1490355)\n\n - Fix mouseup event handling when dragging a list record\n (#1490359)\n\n - Fix bug where preview_pane setting wasn't always saved\n into user preferences (#1490362)\n\n - Fix bug where messages count was not updated after\n message move/delete with skip_deleted=false (#1490372)\n\n - Fix security issue in contact photo handling\n (#1490379)\n\n - Fix possible memcache/apc cache data consistency\n issues (#1490390)\n\n - Fix bug where imap_conn_options were ignored in IMAP\n connection test (#1490392)\n\n - Fix bug where some files could have 'executable'\n extension when stored in temp folder (#1490377)\n\n - Fix attached file path unsetting in\n database_attachments plugin (#1490393)\n\n - Fix issues when using moduserprefs.sh without --user\n argument (#1490399)\n\n - Fix potential info disclosure issue by protecting\n directory access (#1490378)\n\n - Fix blank image in html_signature when saving identity\n changes (#1490412)\n\n - Installer: Use openssl_random_pseudo_bytes() (if\n available) to generate des_key (#1490402)\n\n - Fix XSS vulnerability in _mbox argument handling\n (#1490417)\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.redhat.com/show_bug.cgi?id=1241056\"\n );\n # https://lists.fedoraproject.org/pipermail/package-announce/2015-July/162461.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?f0e6d6b0\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected roundcubemail package.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:roundcubemail\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:fedoraproject:fedora:22\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2015/07/13\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2015/07/29\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2015-2017 Tenable Network Security, Inc.\");\n script_family(english:\"Fedora Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Fedora\" >!< release) audit(AUDIT_OS_NOT, \"Fedora\");\nos_ver = eregmatch(pattern: \"Fedora.*release ([0-9]+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Fedora\");\nos_ver = os_ver[1];\nif (! ereg(pattern:\"^22([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Fedora 22.x\", \"Fedora \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Fedora\", cpu);\n\nflag = 0;\nif (rpm_check(release:\"FC22\", reference:\"roundcubemail-1.1.2-1.fc22\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());\n else security_warning(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"roundcubemail\");\n}\n", "title": "Fedora 22 : roundcubemail-1.1.2-1.fc22 (2015-11405)", "type": "nessus", "viewCount": 0}, "differentElements": ["modified", "sourceData"], "edition": 4, "lastseen": "2017-10-29T13:40:05"}, {"bulletin": {"bulletinFamily": "scanner", "cpe": ["p-cpe:/a:fedoraproject:fedora:roundcubemail", "cpe:/o:fedoraproject:fedora:22"], "cvelist": ["CVE-2015-5381", "CVE-2015-5383", "CVE-2015-5382"], "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:NONE/A:NONE/"}, "description": "**Release 1.1.2**\n\n - Add new plugin hook 'identity_create_after' providing\n the ID of the inserted identity (#1490358)\n\n - Add option to place signature at bottom of the quoted\n text even in top-posting mode [sig_below]\n\n - Fix handling of %-encoded entities in mailto: URLs\n (#1490346)\n\n - Fix zipped messages downloads after selecting all\n messages in a folder (#1490339)\n\n - Fix vpopmaild driver of password plugin\n\n - Fix PHP warning: Non-static method\n PEAR::setErrorHandling() should not be called\n statically (#1490343)\n\n - Fix tables listing routine on mysql and postgres so it\n skips system or other database tables and views\n (#1490337)\n\n - Fix message list header in classic skin on window\n resize in Internet Explorer (#1490213)\n\n - Fix so text/calendar parts are listed as attachments\n even if not marked as such (#1490325)\n\n - Fix lack of signature separator for plain text\n signatures in html mode (#1490352)\n\n - Fix font artifact in Google Chrome on Windows\n (#1490353)\n\n - Fix bug where forced extwin page reload could exit\n from the extwin mode (#1490350)\n\n - Fix bug where some unrelated attachments in\n multipart/related message were not listed (#1490355)\n\n - Fix mouseup event handling when dragging a list record\n (#1490359)\n\n - Fix bug where preview_pane setting wasn't always saved\n into user preferences (#1490362)\n\n - Fix bug where messages count was not updated after\n message move/delete with skip_deleted=false (#1490372)\n\n - Fix security issue in contact photo handling\n (#1490379)\n\n - Fix possible memcache/apc cache data consistency\n issues (#1490390)\n\n - Fix bug where imap_conn_options were ignored in IMAP\n connection test (#1490392)\n\n - Fix bug where some files could have 'executable'\n extension when stored in temp folder (#1490377)\n\n - Fix attached file path unsetting in\n database_attachments plugin (#1490393)\n\n - Fix issues when using moduserprefs.sh without --user\n argument (#1490399)\n\n - Fix potential info disclosure issue by protecting\n directory access (#1490378)\n\n - Fix blank image in html_signature when saving identity\n changes (#1490412)\n\n - Installer: Use openssl_random_pseudo_bytes() (if\n available) to generate des_key (#1490402)\n\n - Fix XSS vulnerability in _mbox argument handling\n (#1490417)\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.", "edition": 8, "enchantments": {"dependencies": {"modified": "2019-01-16T20:22:06", "references": [{"idList": ["CVE-2015-5381", "CVE-2015-5383", "CVE-2015-5382"], "type": "cve"}, {"idList": ["038A5808-24B3-11E5-B0C8-BF4D8935D4FA"], "type": "freebsd"}, {"idList": ["OPENVAS:1361412562310131093", "OPENVAS:1361412562310869812", "OPENVAS:1361412562310108170", "OPENVAS:1361412562310869808"], "type": "openvas"}, {"idList": ["FREEBSD_PKG_038A580824B311E5B0C8BF4D8935D4FA.NASL", "FEDORA_2015-11469.NASL"], "type": "nessus"}]}, "score": {"value": 5.0, "vector": "NONE"}}, "hash": "9dae70b1cc589bee1ad04c9f7338b2bc800dbba9b094b64fb132fc73ea5a7b4e", "hashmap": [{"hash": "109be886b34e1faf954efee8d1f4fe78", "key": "title"}, {"hash": "e94dae84fac5b8517c1cea71aefc4971", "key": "cvelist"}, {"hash": "3b6bf49702d7579a55b7e6f3efb3fc26", "key": "pluginID"}, {"hash": "8b12d0b56a577712a6cf4fbc35538269", "key": "published"}, {"hash": "e95b7aa23e6110a09a0594f094d21edc", "key": "references"}, {"hash": "9cf00d658b687f030ebe173a0528c567", "key": "reporter"}, {"hash": "f53d84b9efaf4517b420dd2e3a4f1f3f", "key": "modified"}, {"hash": "25701220924168a390e5fa01fd26eb37", "key": "cpe"}, {"hash": "a748f05daf7beef7be570582018c1404", "key": "sourceData"}, {"hash": "a792e2393dff1e200b885c5245988f6f", "key": "cvss"}, {"hash": "bbdaea376f500d25f6b0c1050311dd07", "key": "bulletinFamily"}, {"hash": "5e0bd03bec244039678f2b955a2595aa", "key": "type"}, {"hash": "be931514784f88df80712740ad2723e7", "key": "naslFamily"}, {"hash": "5a3c8da19f5ce4a556d617a1691c81a0", "key": "href"}, {"hash": "8304fdb6d67e9d16fef8c09e43575fc6", "key": "description"}], "history": [], "href": "https://www.tenable.com/plugins/index.php?view=single&id=85058", "id": "FEDORA_2015-11405.NASL", "lastseen": "2019-01-16T20:22:06", "modified": "2018-01-30T00:00:00", "naslFamily": "Fedora Local Security Checks", "objectVersion": "1.3", "pluginID": "85058", "published": "2015-07-29T00:00:00", "references": ["http://www.nessus.org/u?f0e6d6b0", "https://bugzilla.redhat.com/show_bug.cgi?id=1241056"], "reporter": "Tenable", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Fedora Security Advisory 2015-11405.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(85058);\n script_version(\"$Revision: 2.4 $\");\n script_cvs_date(\"$Date: 2018/01/30 17:46:07 $\");\n\n script_cve_id(\"CVE-2015-5381\", \"CVE-2015-5382\", \"CVE-2015-5383\");\n script_xref(name:\"FEDORA\", value:\"2015-11405\");\n\n script_name(english:\"Fedora 22 : roundcubemail-1.1.2-1.fc22 (2015-11405)\");\n script_summary(english:\"Checks rpm output for the updated package.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Fedora host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"**Release 1.1.2**\n\n - Add new plugin hook 'identity_create_after' providing\n the ID of the inserted identity (#1490358)\n\n - Add option to place signature at bottom of the quoted\n text even in top-posting mode [sig_below]\n\n - Fix handling of %-encoded entities in mailto: URLs\n (#1490346)\n\n - Fix zipped messages downloads after selecting all\n messages in a folder (#1490339)\n\n - Fix vpopmaild driver of password plugin\n\n - Fix PHP warning: Non-static method\n PEAR::setErrorHandling() should not be called\n statically (#1490343)\n\n - Fix tables listing routine on mysql and postgres so it\n skips system or other database tables and views\n (#1490337)\n\n - Fix message list header in classic skin on window\n resize in Internet Explorer (#1490213)\n\n - Fix so text/calendar parts are listed as attachments\n even if not marked as such (#1490325)\n\n - Fix lack of signature separator for plain text\n signatures in html mode (#1490352)\n\n - Fix font artifact in Google Chrome on Windows\n (#1490353)\n\n - Fix bug where forced extwin page reload could exit\n from the extwin mode (#1490350)\n\n - Fix bug where some unrelated attachments in\n multipart/related message were not listed (#1490355)\n\n - Fix mouseup event handling when dragging a list record\n (#1490359)\n\n - Fix bug where preview_pane setting wasn't always saved\n into user preferences (#1490362)\n\n - Fix bug where messages count was not updated after\n message move/delete with skip_deleted=false (#1490372)\n\n - Fix security issue in contact photo handling\n (#1490379)\n\n - Fix possible memcache/apc cache data consistency\n issues (#1490390)\n\n - Fix bug where imap_conn_options were ignored in IMAP\n connection test (#1490392)\n\n - Fix bug where some files could have 'executable'\n extension when stored in temp folder (#1490377)\n\n - Fix attached file path unsetting in\n database_attachments plugin (#1490393)\n\n - Fix issues when using moduserprefs.sh without --user\n argument (#1490399)\n\n - Fix potential info disclosure issue by protecting\n directory access (#1490378)\n\n - Fix blank image in html_signature when saving identity\n changes (#1490412)\n\n - Installer: Use openssl_random_pseudo_bytes() (if\n available) to generate des_key (#1490402)\n\n - Fix XSS vulnerability in _mbox argument handling\n (#1490417)\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.redhat.com/show_bug.cgi?id=1241056\"\n );\n # https://lists.fedoraproject.org/pipermail/package-announce/2015-July/162461.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?f0e6d6b0\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected roundcubemail package.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:roundcubemail\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:fedoraproject:fedora:22\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2015/07/13\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2015/07/29\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2015-2018 Tenable Network Security, Inc.\");\n script_family(english:\"Fedora Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Fedora\" >!< release) audit(AUDIT_OS_NOT, \"Fedora\");\nos_ver = eregmatch(pattern: \"Fedora.*release ([0-9]+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Fedora\");\nos_ver = os_ver[1];\nif (! ereg(pattern:\"^22([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Fedora 22.x\", \"Fedora \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Fedora\", cpu);\n\nflag = 0;\nif (rpm_check(release:\"FC22\", reference:\"roundcubemail-1.1.2-1.fc22\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());\n else security_warning(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"roundcubemail\");\n}\n", "title": "Fedora 22 : roundcubemail-1.1.2-1.fc22 (2015-11405)", "type": "nessus", "viewCount": 0}, "differentElements": ["description"], "edition": 8, "lastseen": "2019-01-16T20:22:06"}, {"bulletin": {"bulletinFamily": "scanner", "cpe": ["p-cpe:/a:fedoraproject:fedora:roundcubemail", "cpe:/o:fedoraproject:fedora:22"], "cvelist": ["CVE-2015-5381", "CVE-2015-5383", "CVE-2015-5382"], "cvss": {"score": 0.0, "vector": "NONE"}, "description": "**Release 1.1.2**\n\n - Add new plugin hook 'identity_create_after' providing the ID of the inserted identity (#1490358)\n\n - Add option to place signature at bottom of the quoted text even in top-posting mode [sig_below]\n\n - Fix handling of %-encoded entities in mailto: URLs (#1490346)\n\n - Fix zipped messages downloads after selecting all messages in a folder (#1490339)\n\n - Fix vpopmaild driver of password plugin\n\n - Fix PHP warning: Non-static method PEAR::setErrorHandling() should not be called statically (#1490343)\n\n - Fix tables listing routine on mysql and postgres so it skips system or other database tables and views (#1490337)\n\n - Fix message list header in classic skin on window resize in Internet Explorer (#1490213)\n\n - Fix so text/calendar parts are listed as attachments even if not marked as such (#1490325)\n\n - Fix lack of signature separator for plain text signatures in html mode (#1490352)\n\n - Fix font artifact in Google Chrome on Windows (#1490353)\n\n - Fix bug where forced extwin page reload could exit from the extwin mode (#1490350)\n\n - Fix bug where some unrelated attachments in multipart/related message were not listed (#1490355)\n\n - Fix mouseup event handling when dragging a list record (#1490359)\n\n - Fix bug where preview_pane setting wasn't always saved into user preferences (#1490362)\n\n - Fix bug where messages count was not updated after message move/delete with skip_deleted=false (#1490372)\n\n - Fix security issue in contact photo handling (#1490379)\n\n - Fix possible memcache/apc cache data consistency issues (#1490390)\n\n - Fix bug where imap_conn_options were ignored in IMAP connection test (#1490392)\n\n - Fix bug where some files could have 'executable' extension when stored in temp folder (#1490377)\n\n - Fix attached file path unsetting in database_attachments plugin (#1490393)\n\n - Fix issues when using moduserprefs.sh without --user argument (#1490399)\n\n - Fix potential info disclosure issue by protecting directory access (#1490378)\n\n - Fix blank image in html_signature when saving identity changes (#1490412)\n\n - Installer: Use openssl_random_pseudo_bytes() (if available) to generate des_key (#1490402)\n\n - Fix XSS vulnerability in _mbox argument handling (#1490417)\n\nNote that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "edition": 6, "enchantments": {"score": {"value": 5.0, "vector": "NONE"}}, "hash": "70f1b3951abbb4309f811adefa489e1c1b06ee25570ead3588fb2e5213fe795d", "hashmap": [{"hash": "109be886b34e1faf954efee8d1f4fe78", "key": "title"}, {"hash": "e94dae84fac5b8517c1cea71aefc4971", "key": "cvelist"}, {"hash": "3b6bf49702d7579a55b7e6f3efb3fc26", "key": "pluginID"}, {"hash": "8b12d0b56a577712a6cf4fbc35538269", "key": "published"}, {"hash": "e95b7aa23e6110a09a0594f094d21edc", "key": "references"}, {"hash": "9cf00d658b687f030ebe173a0528c567", "key": "reporter"}, {"hash": "f53d84b9efaf4517b420dd2e3a4f1f3f", "key": "modified"}, {"hash": "25701220924168a390e5fa01fd26eb37", "key": "cpe"}, {"hash": "a748f05daf7beef7be570582018c1404", "key": "sourceData"}, {"hash": "8cd4821cb504d25572038ed182587d85", "key": "cvss"}, {"hash": "bbdaea376f500d25f6b0c1050311dd07", "key": "bulletinFamily"}, {"hash": "5e0bd03bec244039678f2b955a2595aa", "key": "type"}, {"hash": "34dfbbf45410802bb1338384300dc474", "key": "description"}, {"hash": "be931514784f88df80712740ad2723e7", "key": "naslFamily"}, {"hash": "5a3c8da19f5ce4a556d617a1691c81a0", "key": "href"}], "history": [], "href": "https://www.tenable.com/plugins/index.php?view=single&id=85058", "id": "FEDORA_2015-11405.NASL", "lastseen": "2018-08-30T19:46:52", "modified": "2018-01-30T00:00:00", "naslFamily": "Fedora Local Security Checks", "objectVersion": "1.3", "pluginID": "85058", "published": "2015-07-29T00:00:00", "references": ["http://www.nessus.org/u?f0e6d6b0", "https://bugzilla.redhat.com/show_bug.cgi?id=1241056"], "reporter": "Tenable", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Fedora Security Advisory 2015-11405.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(85058);\n script_version(\"$Revision: 2.4 $\");\n script_cvs_date(\"$Date: 2018/01/30 17:46:07 $\");\n\n script_cve_id(\"CVE-2015-5381\", \"CVE-2015-5382\", \"CVE-2015-5383\");\n script_xref(name:\"FEDORA\", value:\"2015-11405\");\n\n script_name(english:\"Fedora 22 : roundcubemail-1.1.2-1.fc22 (2015-11405)\");\n script_summary(english:\"Checks rpm output for the updated package.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Fedora host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"**Release 1.1.2**\n\n - Add new plugin hook 'identity_create_after' providing\n the ID of the inserted identity (#1490358)\n\n - Add option to place signature at bottom of the quoted\n text even in top-posting mode [sig_below]\n\n - Fix handling of %-encoded entities in mailto: URLs\n (#1490346)\n\n - Fix zipped messages downloads after selecting all\n messages in a folder (#1490339)\n\n - Fix vpopmaild driver of password plugin\n\n - Fix PHP warning: Non-static method\n PEAR::setErrorHandling() should not be called\n statically (#1490343)\n\n - Fix tables listing routine on mysql and postgres so it\n skips system or other database tables and views\n (#1490337)\n\n - Fix message list header in classic skin on window\n resize in Internet Explorer (#1490213)\n\n - Fix so text/calendar parts are listed as attachments\n even if not marked as such (#1490325)\n\n - Fix lack of signature separator for plain text\n signatures in html mode (#1490352)\n\n - Fix font artifact in Google Chrome on Windows\n (#1490353)\n\n - Fix bug where forced extwin page reload could exit\n from the extwin mode (#1490350)\n\n - Fix bug where some unrelated attachments in\n multipart/related message were not listed (#1490355)\n\n - Fix mouseup event handling when dragging a list record\n (#1490359)\n\n - Fix bug where preview_pane setting wasn't always saved\n into user preferences (#1490362)\n\n - Fix bug where messages count was not updated after\n message move/delete with skip_deleted=false (#1490372)\n\n - Fix security issue in contact photo handling\n (#1490379)\n\n - Fix possible memcache/apc cache data consistency\n issues (#1490390)\n\n - Fix bug where imap_conn_options were ignored in IMAP\n connection test (#1490392)\n\n - Fix bug where some files could have 'executable'\n extension when stored in temp folder (#1490377)\n\n - Fix attached file path unsetting in\n database_attachments plugin (#1490393)\n\n - Fix issues when using moduserprefs.sh without --user\n argument (#1490399)\n\n - Fix potential info disclosure issue by protecting\n directory access (#1490378)\n\n - Fix blank image in html_signature when saving identity\n changes (#1490412)\n\n - Installer: Use openssl_random_pseudo_bytes() (if\n available) to generate des_key (#1490402)\n\n - Fix XSS vulnerability in _mbox argument handling\n (#1490417)\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.redhat.com/show_bug.cgi?id=1241056\"\n );\n # https://lists.fedoraproject.org/pipermail/package-announce/2015-July/162461.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?f0e6d6b0\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected roundcubemail package.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:roundcubemail\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:fedoraproject:fedora:22\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2015/07/13\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2015/07/29\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2015-2018 Tenable Network Security, Inc.\");\n script_family(english:\"Fedora Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Fedora\" >!< release) audit(AUDIT_OS_NOT, \"Fedora\");\nos_ver = eregmatch(pattern: \"Fedora.*release ([0-9]+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Fedora\");\nos_ver = os_ver[1];\nif (! ereg(pattern:\"^22([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Fedora 22.x\", \"Fedora \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Fedora\", cpu);\n\nflag = 0;\nif (rpm_check(release:\"FC22\", reference:\"roundcubemail-1.1.2-1.fc22\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());\n else security_warning(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"roundcubemail\");\n}\n", "title": "Fedora 22 : roundcubemail-1.1.2-1.fc22 (2015-11405)", "type": "nessus", "viewCount": 0}, "differentElements": ["cvss"], "edition": 6, "lastseen": "2018-08-30T19:46:52"}], "edition": 11, "hashmap": [{"key": "bulletinFamily", "hash": "bbdaea376f500d25f6b0c1050311dd07"}, {"key": "cpe", "hash": "25701220924168a390e5fa01fd26eb37"}, {"key": "cvelist", "hash": "e94dae84fac5b8517c1cea71aefc4971"}, {"key": "cvss", "hash": "a89198c45ce87f7ec9735a085150b708"}, {"key": "description", "hash": "e4dd13f12799503bd80328274a3a1c82"}, {"key": "href", "hash": "6b5911fa28bb46e51ed4f93e7f98d4a5"}, {"key": "modified", "hash": "abcf9266f425f12dda38f529cd4a94bc"}, {"key": "naslFamily", "hash": "be931514784f88df80712740ad2723e7"}, {"key": "pluginID", "hash": "3b6bf49702d7579a55b7e6f3efb3fc26"}, {"key": "published", "hash": "8b12d0b56a577712a6cf4fbc35538269"}, {"key": "references", "hash": "e95b7aa23e6110a09a0594f094d21edc"}, {"key": "reporter", "hash": "83d85f0b2082533b5c390c185dd3e8ce"}, {"key": "sourceData", "hash": "a748f05daf7beef7be570582018c1404"}, {"key": "title", "hash": "109be886b34e1faf954efee8d1f4fe78"}, {"key": "type", "hash": "5e0bd03bec244039678f2b955a2595aa"}], "hash": "50d112c40a49c4d6f061bfa287c805e0b7e1e566ac67727922e5fe1d42053123", "viewCount": 0, "enchantments": {"dependencies": {"references": [{"type": "openvas", "idList": ["OPENVAS:1361412562310108170", "OPENVAS:1361412562310869812", "OPENVAS:1361412562310869808", "OPENVAS:1361412562310131093"]}, {"type": "cve", "idList": ["CVE-2015-5382", "CVE-2015-5381", "CVE-2015-5383"]}, {"type": "nessus", "idList": ["FEDORA_2015-11469.NASL", "FREEBSD_PKG_038A580824B311E5B0C8BF4D8935D4FA.NASL"]}, {"type": "freebsd", "idList": ["038A5808-24B3-11E5-B0C8-BF4D8935D4FA"]}], "modified": "2019-11-01T02:27:19"}, "score": {"value": 6.4, "vector": "NONE", "modified": "2019-11-01T02:27:19"}, "vulnersScore": 6.4}, "objectVersion": "1.3", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Fedora Security Advisory 2015-11405.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(85058);\n script_version(\"$Revision: 2.4 $\");\n script_cvs_date(\"$Date: 2018/01/30 17:46:07 $\");\n\n script_cve_id(\"CVE-2015-5381\", \"CVE-2015-5382\", \"CVE-2015-5383\");\n script_xref(name:\"FEDORA\", value:\"2015-11405\");\n\n script_name(english:\"Fedora 22 : roundcubemail-1.1.2-1.fc22 (2015-11405)\");\n script_summary(english:\"Checks rpm output for the updated package.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Fedora host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"**Release 1.1.2**\n\n - Add new plugin hook 'identity_create_after' providing\n the ID of the inserted identity (#1490358)\n\n - Add option to place signature at bottom of the quoted\n text even in top-posting mode [sig_below]\n\n - Fix handling of %-encoded entities in mailto: URLs\n (#1490346)\n\n - Fix zipped messages downloads after selecting all\n messages in a folder (#1490339)\n\n - Fix vpopmaild driver of password plugin\n\n - Fix PHP warning: Non-static method\n PEAR::setErrorHandling() should not be called\n statically (#1490343)\n\n - Fix tables listing routine on mysql and postgres so it\n skips system or other database tables and views\n (#1490337)\n\n - Fix message list header in classic skin on window\n resize in Internet Explorer (#1490213)\n\n - Fix so text/calendar parts are listed as attachments\n even if not marked as such (#1490325)\n\n - Fix lack of signature separator for plain text\n signatures in html mode (#1490352)\n\n - Fix font artifact in Google Chrome on Windows\n (#1490353)\n\n - Fix bug where forced extwin page reload could exit\n from the extwin mode (#1490350)\n\n - Fix bug where some unrelated attachments in\n multipart/related message were not listed (#1490355)\n\n - Fix mouseup event handling when dragging a list record\n (#1490359)\n\n - Fix bug where preview_pane setting wasn't always saved\n into user preferences (#1490362)\n\n - Fix bug where messages count was not updated after\n message move/delete with skip_deleted=false (#1490372)\n\n - Fix security issue in contact photo handling\n (#1490379)\n\n - Fix possible memcache/apc cache data consistency\n issues (#1490390)\n\n - Fix bug where imap_conn_options were ignored in IMAP\n connection test (#1490392)\n\n - Fix bug where some files could have 'executable'\n extension when stored in temp folder (#1490377)\n\n - Fix attached file path unsetting in\n database_attachments plugin (#1490393)\n\n - Fix issues when using moduserprefs.sh without --user\n argument (#1490399)\n\n - Fix potential info disclosure issue by protecting\n directory access (#1490378)\n\n - Fix blank image in html_signature when saving identity\n changes (#1490412)\n\n - Installer: Use openssl_random_pseudo_bytes() (if\n available) to generate des_key (#1490402)\n\n - Fix XSS vulnerability in _mbox argument handling\n (#1490417)\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.redhat.com/show_bug.cgi?id=1241056\"\n );\n # https://lists.fedoraproject.org/pipermail/package-announce/2015-July/162461.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?f0e6d6b0\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected roundcubemail package.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:roundcubemail\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:fedoraproject:fedora:22\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2015/07/13\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2015/07/29\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2015-2018 Tenable Network Security, Inc.\");\n script_family(english:\"Fedora Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Fedora\" >!< release) audit(AUDIT_OS_NOT, \"Fedora\");\nos_ver = eregmatch(pattern: \"Fedora.*release ([0-9]+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Fedora\");\nos_ver = os_ver[1];\nif (! ereg(pattern:\"^22([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Fedora 22.x\", \"Fedora \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Fedora\", cpu);\n\nflag = 0;\nif (rpm_check(release:\"FC22\", reference:\"roundcubemail-1.1.2-1.fc22\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());\n else security_warning(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"roundcubemail\");\n}\n", "naslFamily": "Fedora Local Security Checks", "pluginID": "85058", "cpe": ["p-cpe:/a:fedoraproject:fedora:roundcubemail", "cpe:/o:fedoraproject:fedora:22"], "scheme": null}
{"openvas": [{"lastseen": "2019-09-12T17:20:09", "bulletinFamily": "scanner", "description": "This host is installed with Roundcube Webmail and is prone to\n multiple vulnerabilities.", "modified": "2019-09-10T00:00:00", "published": "2017-05-30T00:00:00", "id": "OPENVAS:1361412562310108170", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310108170", "title": "Roundcube Webmail CVE-2015-5381 - CVE-2015-5383 Multiple Vulnerabilities", "type": "openvas", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Roundcube Webmail CVE-2015-5381 - CVE-2015-5383 Multiple Vulnerabilities\n#\n# Authors:\n# Christian Fischer <christian.fischer@greenbone.net>\n#\n# Copyright:\n# Copyright (c) 2017 Greenbone Networks GmbH\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nCPE = 'cpe:/a:roundcube:webmail';\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.108170\");\n script_version(\"2019-09-10T11:55:44+0000\");\n script_tag(name:\"cvss_base\", value:\"5.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:P/I:N/A:N\");\n script_tag(name:\"last_modification\", value:\"2019-09-10 11:55:44 +0000 (Tue, 10 Sep 2019)\");\n script_tag(name:\"creation_date\", value:\"2017-05-30 15:00:00 +0200 (Tue, 30 May 2017)\");\n script_cve_id(\"CVE-2015-5381\", \"CVE-2015-5382\", \"CVE-2015-5383\");\n script_bugtraq_id(98671, 98673);\n script_name(\"Roundcube Webmail CVE-2015-5381 - CVE-2015-5383 Multiple Vulnerabilities\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (c) 2017 Greenbone Networks GmbH\");\n script_family(\"Web application abuses\");\n script_dependencies(\"sw_roundcube_detect.nasl\");\n script_mandatory_keys(\"roundcube/detected\");\n\n script_tag(name:\"summary\", value:\"This host is installed with Roundcube Webmail and is prone to\n multiple vulnerabilities.\");\n\n script_tag(name:\"insight\", value:\"Multiple flaws exists:\n\n - XSS vulnerability in _mbox argument\n\n - security improvement in contact photo handling\n\n - potential info disclosure from temp directory\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable version is present on the target host.\");\n\n script_tag(name:\"impact\", value:\"An attacker may leverage these issues to:\n\n - execute arbitrary script code in the browser of an unsuspecting user in the context of the\n affected site. This may allow the attacker to steal cookie-based authentication credentials\n and to launch other attacks.\n\n - gain access to sensitive information. Information obtained may lead to further attacks.\");\n\n script_tag(name:\"affected\", value:\"Roundcube Webmail versions prior to 1.0.6 and 1.1.x\n versions prior to 1.1.2.\");\n\n script_tag(name:\"solution\", value:\"Upgrade Roundcube Webmail to 1.0.6 or 1.1.2 or later.\");\n\n script_xref(name:\"URL\", value:\"https://roundcube.net/news/2015/06/05/updates-1.1.2-and-1.0.6-released\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"qod_type\", value:\"remote_banner_unreliable\");\n\n exit(0);\n}\n\ninclude(\"version_func.inc\");\ninclude(\"host_details.inc\");\n\nif(!port = get_app_port(cpe: CPE))\n exit(0);\n\nif(!infos = get_app_version_and_location(cpe: CPE, port: port, exit_no_version: TRUE))\n exit(0);\n\nversion = infos['version'];\npath = infos['location'];\n\nif( version_is_less( version:version, test_version:\"1.0.6\" ) ) {\n vuln = TRUE;\n fix = \"1.0.6\";\n}\n\nif( version_in_range( version:version, test_version:\"1.1.0\", test_version2:\"1.1.1\" ) ) {\n vuln = TRUE;\n fix = \"1.1.2\";\n}\n\nif( vuln ) {\n report = report_fixed_ver( installed_version:version, fixed_version:fix, install_path:path );\n security_message( port:port, data:report );\n exit( 0 );\n}\n\nexit( 99 );\n", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N"}}, {"lastseen": "2019-05-29T18:35:52", "bulletinFamily": "scanner", "description": "The remote host is missing an update for the ", "modified": "2019-03-15T00:00:00", "published": "2015-07-30T00:00:00", "id": "OPENVAS:1361412562310869812", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310869812", "title": "Fedora Update for roundcubemail FEDORA-2015-11405", "type": "openvas", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Fedora Update for roundcubemail FEDORA-2015-11405\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (C) 2015 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.869812\");\n script_version(\"$Revision: 14223 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2019-03-15 14:49:35 +0100 (Fri, 15 Mar 2019) $\");\n script_tag(name:\"creation_date\", value:\"2015-07-30 05:06:04 +0200 (Thu, 30 Jul 2015)\");\n script_cve_id(\"CVE-2015-5381\", \"CVE-2015-5382\", \"CVE-2015-5383\");\n script_tag(name:\"cvss_base\", value:\"5.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:P/I:N/A:N\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_name(\"Fedora Update for roundcubemail FEDORA-2015-11405\");\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'roundcubemail'\n package(s) announced via the referenced advisory.\");\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable version is present on the target host.\");\n script_tag(name:\"affected\", value:\"roundcubemail on Fedora 22\");\n script_tag(name:\"solution\", value:\"Please install the updated package(s).\");\n script_xref(name:\"FEDORA\", value:\"2015-11405\");\n script_xref(name:\"URL\", value:\"https://lists.fedoraproject.org/pipermail/package-announce/2015-July/162461.html\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2015 Greenbone Networks GmbH\");\n script_family(\"Fedora Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/fedora\", \"ssh/login/rpms\", re:\"ssh/login/release=FC22\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\n\nif(release == \"FC22\")\n{\n\n if ((res = isrpmvuln(pkg:\"roundcubemail\", rpm:\"roundcubemail~1.1.2~1.fc22\", rls:\"FC22\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99);\n exit(0);\n}\n", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N"}}, {"lastseen": "2019-05-29T18:36:36", "bulletinFamily": "scanner", "description": "The remote host is missing an update for the ", "modified": "2019-03-15T00:00:00", "published": "2015-07-30T00:00:00", "id": "OPENVAS:1361412562310869808", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310869808", "title": "Fedora Update for roundcubemail FEDORA-2015-11469", "type": "openvas", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Fedora Update for roundcubemail FEDORA-2015-11469\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (C) 2015 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.869808\");\n script_version(\"$Revision: 14223 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2019-03-15 14:49:35 +0100 (Fri, 15 Mar 2019) $\");\n script_tag(name:\"creation_date\", value:\"2015-07-30 05:05:00 +0200 (Thu, 30 Jul 2015)\");\n script_cve_id(\"CVE-2015-5381\", \"CVE-2015-5382\", \"CVE-2015-5383\", \"CVE-2012-4230\");\n script_tag(name:\"cvss_base\", value:\"5.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:P/I:N/A:N\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_name(\"Fedora Update for roundcubemail FEDORA-2015-11469\");\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'roundcubemail'\n package(s) announced via the referenced advisory.\");\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable version is present on the target host.\");\n script_tag(name:\"affected\", value:\"roundcubemail on Fedora 21\");\n script_tag(name:\"solution\", value:\"Please install the updated package(s).\");\n script_xref(name:\"FEDORA\", value:\"2015-11469\");\n script_xref(name:\"URL\", value:\"https://lists.fedoraproject.org/pipermail/package-announce/2015-July/162542.html\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2015 Greenbone Networks GmbH\");\n script_family(\"Fedora Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/fedora\", \"ssh/login/rpms\", re:\"ssh/login/release=FC21\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\n\nif(release == \"FC21\")\n{\n\n if ((res = isrpmvuln(pkg:\"roundcubemail\", rpm:\"roundcubemail~1.1.2~1.fc21\", rls:\"FC21\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99);\n exit(0);\n}\n", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N"}}, {"lastseen": "2019-05-29T18:36:25", "bulletinFamily": "scanner", "description": "Mageia Linux Local Security Checks mgasa-2015-0400", "modified": "2018-09-28T00:00:00", "published": "2015-10-15T00:00:00", "id": "OPENVAS:1361412562310131093", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310131093", "title": "Mageia Linux Local Check: mgasa-2015-0400", "type": "openvas", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n# $Id: mgasa-2015-0400.nasl 11692 2018-09-28 16:55:19Z cfischer $\n#\n# Mageia Linux security check\n#\n# Authors:\n# Eero Volotinen <eero.volotinen@solinor.com>\n#\n# Copyright:\n# Copyright (c) 2015 Eero Volotinen, http://www.solinor.com\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.131093\");\n script_version(\"$Revision: 11692 $\");\n script_tag(name:\"creation_date\", value:\"2015-10-15 06:54:50 +0300 (Thu, 15 Oct 2015)\");\n script_tag(name:\"last_modification\", value:\"$Date: 2018-09-28 18:55:19 +0200 (Fri, 28 Sep 2018) $\");\n script_name(\"Mageia Linux Local Check: mgasa-2015-0400\");\n script_tag(name:\"insight\", value:\"Multiple security issues in the DBMail driver for the password plugin, including buffer overflows (CVE-2015-2181) and the ability for a remote attacker to execute arbitrary shell commands as root (CVE-2015-2180). An authenticated user can download arbitrary files from the web server that the web server process has read access to, by uploading a vCard with a specially crafted POST (CVE-2015-5382). The roundcubemail package has been updated to version 1.0.6, fixing these issues and several other bugs, however the installer is currently known to be broken.\");\n script_tag(name:\"solution\", value:\"Update the affected packages to the latest available version.\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_xref(name:\"URL\", value:\"https://advisories.mageia.org/MGASA-2015-0400.html\");\n script_cve_id(\"CVE-2015-2180\", \"CVE-2015-2181\", \"CVE-2015-5382\");\n script_tag(name:\"cvss_base\", value:\"9.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:S/C:C/I:C/A:C\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/mageia_linux\", \"ssh/login/release\", re:\"ssh/login/release=MAGEIA5\");\n script_category(ACT_GATHER_INFO);\n script_tag(name:\"summary\", value:\"Mageia Linux Local Security Checks mgasa-2015-0400\");\n script_copyright(\"Eero Volotinen\");\n script_family(\"Mageia Linux Local Security Checks\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release) exit(0);\n\nres = \"\";\n\nif(release == \"MAGEIA5\")\n{\nif ((res = isrpmvuln(pkg:\"roundcubemail\", rpm:\"roundcubemail~1.0.6~1.1.mga5\", rls:\"MAGEIA5\")) != NULL) {\n security_message(data:res);\n exit(0);\n}\nif (__pkg_match) exit(99);\n exit(0);\n}\n", "cvss": {"score": 9.0, "vector": "AV:N/AC:L/Au:S/C:C/I:C/A:C"}}], "cve": [{"lastseen": "2019-05-29T18:14:43", "bulletinFamily": "NVD", "description": "program/steps/addressbook/photo.inc in Roundcube Webmail before 1.0.6 and 1.1.x before 1.1.2 allows remote authenticated users to read arbitrary files via the _alt parameter when uploading a vCard.", "modified": "2018-10-30T16:27:00", "id": "CVE-2015-5382", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-5382", "published": "2017-05-23T04:29:00", "title": "CVE-2015-5382", "type": "cve", "cvss": {"score": 4.0, "vector": "AV:N/AC:L/Au:S/C:P/I:N/A:N"}}, {"lastseen": "2019-05-29T18:14:43", "bulletinFamily": "NVD", "description": "Cross-site scripting (XSS) vulnerability in program/include/rcmail.php in Roundcube Webmail 1.1.x before 1.1.2 allows remote attackers to inject arbitrary web script or HTML via the _mbox parameter to the default URI.", "modified": "2018-10-30T16:27:00", "id": "CVE-2015-5381", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-5381", "published": "2017-05-23T04:29:00", "title": "CVE-2015-5381", "type": "cve", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N"}}, {"lastseen": "2019-05-29T18:14:43", "bulletinFamily": "NVD", "description": "Roundcube Webmail 1.1.x before 1.1.2 allows remote attackers to obtain sensitive information by reading files in the (1) config, (2) temp, or (3) logs directory.", "modified": "2018-10-30T16:27:00", "id": "CVE-2015-5383", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-5383", "published": "2017-05-23T04:29:00", "title": "CVE-2015-5383", "type": "cve", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N"}}], "nessus": [{"lastseen": "2019-11-01T02:27:19", "bulletinFamily": "scanner", "description": "**Release 1.1.2**\n\n - Add new plugin hook ", "modified": "2019-11-02T00:00:00", "id": "FEDORA_2015-11469.NASL", "href": "https://www.tenable.com/plugins/nessus/85059", "published": "2015-07-29T00:00:00", "title": "Fedora 21 : roundcubemail-1.1.2-1.fc21 (2015-11469)", "type": "nessus", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Fedora Security Advisory 2015-11469.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(85059);\n script_version(\"$Revision: 2.4 $\");\n script_cvs_date(\"$Date: 2018/01/30 17:46:07 $\");\n\n script_cve_id(\"CVE-2015-5381\", \"CVE-2015-5382\", \"CVE-2015-5383\");\n script_xref(name:\"FEDORA\", value:\"2015-11469\");\n\n script_name(english:\"Fedora 21 : roundcubemail-1.1.2-1.fc21 (2015-11469)\");\n script_summary(english:\"Checks rpm output for the updated package.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Fedora host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"**Release 1.1.2**\n\n - Add new plugin hook 'identity_create_after' providing\n the ID of the inserted identity (#1490358)\n\n - Add option to place signature at bottom of the quoted\n text even in top-posting mode [sig_below]\n\n - Fix handling of %-encoded entities in mailto: URLs\n (#1490346)\n\n - Fix zipped messages downloads after selecting all\n messages in a folder (#1490339)\n\n - Fix vpopmaild driver of password plugin\n\n - Fix PHP warning: Non-static method\n PEAR::setErrorHandling() should not be called\n statically (#1490343)\n\n - Fix tables listing routine on mysql and postgres so it\n skips system or other database tables and views\n (#1490337)\n\n - Fix message list header in classic skin on window\n resize in Internet Explorer (#1490213)\n\n - Fix so text/calendar parts are listed as attachments\n even if not marked as such (#1490325)\n\n - Fix lack of signature separator for plain text\n signatures in html mode (#1490352)\n\n - Fix font artifact in Google Chrome on Windows\n (#1490353)\n\n - Fix bug where forced extwin page reload could exit\n from the extwin mode (#1490350)\n\n - Fix bug where some unrelated attachments in\n multipart/related message were not listed (#1490355)\n\n - Fix mouseup event handling when dragging a list record\n (#1490359)\n\n - Fix bug where preview_pane setting wasn't always saved\n into user preferences (#1490362)\n\n - Fix bug where messages count was not updated after\n message move/delete with skip_deleted=false (#1490372)\n\n - Fix security issue in contact photo handling\n (#1490379)\n\n - Fix possible memcache/apc cache data consistency\n issues (#1490390)\n\n - Fix bug where imap_conn_options were ignored in IMAP\n connection test (#1490392)\n\n - Fix bug where some files could have 'executable'\n extension when stored in temp folder (#1490377)\n\n - Fix attached file path unsetting in\n database_attachments plugin (#1490393)\n\n - Fix issues when using moduserprefs.sh without --user\n argument (#1490399)\n\n - Fix potential info disclosure issue by protecting\n directory access (#1490378)\n\n - Fix blank image in html_signature when saving identity\n changes (#1490412)\n\n - Installer: Use openssl_random_pseudo_bytes() (if\n available) to generate des_key (#1490402)\n\n - Fix XSS vulnerability in _mbox argument handling\n (#1490417)\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.redhat.com/show_bug.cgi?id=1241056\"\n );\n # https://lists.fedoraproject.org/pipermail/package-announce/2015-July/162542.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?54a7dfdf\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected roundcubemail package.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:roundcubemail\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:fedoraproject:fedora:21\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2015/07/13\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2015/07/29\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2015-2018 Tenable Network Security, Inc.\");\n script_family(english:\"Fedora Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Fedora\" >!< release) audit(AUDIT_OS_NOT, \"Fedora\");\nos_ver = eregmatch(pattern: \"Fedora.*release ([0-9]+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Fedora\");\nos_ver = os_ver[1];\nif (! ereg(pattern:\"^21([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Fedora 21.x\", \"Fedora \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Fedora\", cpu);\n\nflag = 0;\nif (rpm_check(release:\"FC21\", reference:\"roundcubemail-1.1.2-1.fc21\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());\n else security_warning(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"roundcubemail\");\n}\n", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N"}}, {"lastseen": "2019-11-01T02:36:53", "bulletinFamily": "scanner", "description": "Roundcube reports :\n\nWe just published updates to both stable versions 1.0 and 1.1 after\nfixing many minor bugs and adding some security improvements to the\n1.1 release branch. Version 1.0.6 comes with cherry-picked fixes from\nthe more recent version to ensure proper long term support especially\nin regards of security and compatibility. The security-related fixes\nin particular are : * XSS vulnerability in _mbox argument * security\nimprovement in contact photo handling * potential info disclosure from\ntemp directory", "modified": "2019-11-02T00:00:00", "id": "FREEBSD_PKG_038A580824B311E5B0C8BF4D8935D4FA.NASL", "href": "https://www.tenable.com/plugins/nessus/84600", "published": "2015-07-08T00:00:00", "title": "FreeBSD : roundcube -- multiple vulnerabilities (038a5808-24b3-11e5-b0c8-bf4d8935d4fa)", "type": "nessus", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from the FreeBSD VuXML database :\n#\n# Copyright 2003-2018 Jacques Vidrine and contributors\n#\n# Redistribution and use in source (VuXML) and 'compiled' forms (SGML,\n# HTML, PDF, PostScript, RTF and so forth) with or without modification,\n# are permitted provided that the following conditions are met:\n# 1. Redistributions of source code (VuXML) must retain the above\n# copyright notice, this list of conditions and the following\n# disclaimer as the first lines of this file unmodified.\n# 2. Redistributions in compiled form (transformed to other DTDs,\n# published online in any format, converted to PDF, PostScript,\n# RTF and other formats) must reproduce the above copyright\n# notice, this list of conditions and the following disclaimer\n# in the documentation and/or other materials provided with the\n# distribution.\n# \n# THIS DOCUMENTATION IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS \"AS IS\"\n# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,\n# THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR\n# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS\n# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,\n# OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT\n# OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR\n# BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,\n# WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE\n# OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS DOCUMENTATION,\n# EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(84600);\n script_version(\"2.6\");\n script_cvs_date(\"Date: 2018/12/19 13:21:18\");\n\n script_cve_id(\"CVE-2015-5381\", \"CVE-2015-5383\");\n\n script_name(english:\"FreeBSD : roundcube -- multiple vulnerabilities (038a5808-24b3-11e5-b0c8-bf4d8935d4fa)\");\n script_summary(english:\"Checks for updated packages in pkg_info output\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\n\"The remote FreeBSD host is missing one or more security-related\nupdates.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Roundcube reports :\n\nWe just published updates to both stable versions 1.0 and 1.1 after\nfixing many minor bugs and adding some security improvements to the\n1.1 release branch. Version 1.0.6 comes with cherry-picked fixes from\nthe more recent version to ensure proper long term support especially\nin regards of security and compatibility. The security-related fixes\nin particular are : * XSS vulnerability in _mbox argument * security\nimprovement in contact photo handling * potential info disclosure from\ntemp directory\"\n );\n # http://openwall.com/lists/oss-security/2015/07/06/10\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.openwall.com/lists/oss-security/2015/07/06/10\"\n );\n # https://roundcube.net/news/2015/06/05/updates-1.1.2-and-1.0.6-released/\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?9856915d\"\n );\n # https://vuxml.freebsd.org/freebsd/038a5808-24b3-11e5-b0c8-bf4d8935d4fa.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?27c7bc40\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:freebsd:freebsd:roundcube\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:freebsd:freebsd\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2015/05/30\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2015/07/07\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2015/07/08\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2015-2018 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"FreeBSD Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/FreeBSD/release\", \"Host/FreeBSD/pkg_info\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"freebsd_package.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/FreeBSD/release\")) audit(AUDIT_OS_NOT, \"FreeBSD\");\nif (!get_kb_item(\"Host/FreeBSD/pkg_info\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\n\nif (pkg_test(save_report:TRUE, pkg:\"roundcube>=1.1.0,1<1.1.2,1\")) flag++;\nif (pkg_test(save_report:TRUE, pkg:\"roundcube<1.0.6,1\")) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:pkg_report_get());\n else security_warning(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N"}}], "freebsd": [{"lastseen": "2019-05-29T18:33:11", "bulletinFamily": "unix", "description": "\nRoundcube reports:\n\nWe just published updates to both stable versions 1.0 and\n\t 1.1 after fixing many minor bugs and adding some security improvements\n\t to the 1.1 release branch. Version 1.0.6 comes with cherry-picked fixes\n\t from the more recent version to ensure proper long term support\n\t especially in regards of security and compatibility.\n\n\t The security-related fixes in particular are:\n\n\t * XSS vulnerability in _mbox argument\n\t * security improvement in contact photo handling\n\t * potential info disclosure from temp directory\n\n", "modified": "2015-05-30T00:00:00", "published": "2015-05-30T00:00:00", "id": "038A5808-24B3-11E5-B0C8-BF4D8935D4FA", "href": "https://vuxml.freebsd.org/freebsd/038a5808-24b3-11e5-b0c8-bf4d8935d4fa.html", "title": "roundcube -- multiple vulnerabilities", "type": "freebsd", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N"}}]}