Security update for roundcubemail (important)

2016-12-0715:11:46

lists.opensuse.org

0.003 Low

EPSS

Percentile

69.7%

JSON

roundcubemail was updated to version 1.1.7 and fixes the following issues:

Update to 1.1.7
- A maliciously crafted FROM value could cause extra parameters to be
  passed to the sendmail command (boo#1012493)
- A maliciously crafted email could cause untrusted code to be executed
  (cross site scripting using $lt;area href=javascript:…>)
  (boo#982003, CVE-2016-5103)
- Avoid HTML styles that could cause potential click jacking
  (boo#1001856)
Update to 1.1.5
- Fixed security issue in DBMail driver of password plugin
  (CVE-2015-2181, boo#976988)

OSVersionArchitecturePackageVersionFilename
openSUSE Leap42.1noarchroundcubemail< 1.1.7-15.1roundcubemail-1.1.7-15.1.noarch.rpm
openSUSE Leap42.2noarchroundcubemail< 1.1.7-15.1roundcubemail-1.1.7-15.1.noarch.rpm

OS	Version	Architecture	Package	Version	Filename
openSUSE Leap	42.1	noarch	roundcubemail	< 1.1.7-15.1	roundcubemail-1.1.7-15.1.noarch.rpm
openSUSE Leap	42.2	noarch	roundcubemail	< 1.1.7-15.1	roundcubemail-1.1.7-15.1.noarch.rpm