Roundcube vulnerabilities

2024-06-2500:00:00

ubuntu.com

roundcube

ubuntu

svg images

javascript code

headers

user preferences

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

7.7 High

AI Score

Confidence

Low

0.007 Low

EPSS

Percentile

80.1%

JSON

Releases

Ubuntu 23.10
Ubuntu 22.04 LTS
Ubuntu 20.04 LTS
Ubuntu 18.04 ESM
Ubuntu 16.04 ESM

Packages

roundcube - skinnable AJAX based webmail solution for IMAP servers - metapack

Details

Matthieu Faou and Denys Klymenko discovered that Roundcube incorrectly
handled certain SVG images. A remote attacker could possibly use this
issue to load arbitrary JavaScript code. This issue only affected Ubuntu
18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS and Ubuntu 23.10.
(CVE-2023-5631)

Rene Rehme discovered that Roundcube incorrectly handled certain headers.
A remote attacker could possibly use this issue to load arbitrary
JavaScript code. This issue only affected Ubuntu 20.04 LTS,
Ubuntu 22.04 LTS and Ubuntu 23.10. (CVE-2023-47272)

Valentin T. and Lutz Wolf discovered that Roundcube incorrectly handled
certain SVG images. A remote attacker could possibly use this issue to
load arbitrary JavaScript code. This issue only affected Ubuntu 18.04 LTS,
Ubuntu 20.04 LTS, Ubuntu 22.04 LTS and Ubuntu 23.10. (CVE-2024-37383)

Huy Nguyễn Phạm Nhật discovered that Roundcube incorrectly handled
certain fields in user preferences. A remote attacker could possibly use
this issue to load arbitrary JavaScript code. (CVE-2024-37384)

OSVersionArchitecturePackageVersionFilename
Ubuntu23.10noarchroundcube< 1.6.2+dfsg-1ubuntu0.2UNKNOWN
Ubuntu23.10noarchroundcube-core< 1.6.2+dfsg-1ubuntu0.2UNKNOWN
Ubuntu23.10noarchroundcube-mysql< 1.6.2+dfsg-1ubuntu0.2UNKNOWN
Ubuntu23.10noarchroundcube-pgsql< 1.6.2+dfsg-1ubuntu0.2UNKNOWN
Ubuntu23.10noarchroundcube-plugins< 1.6.2+dfsg-1ubuntu0.2UNKNOWN
Ubuntu23.10noarchroundcube-sqlite3< 1.6.2+dfsg-1ubuntu0.2UNKNOWN
Ubuntu22.04noarchroundcube< 1.5.0+dfsg.1-2ubuntu0.1~esm3UNKNOWN
Ubuntu22.04noarchroundcube< 1.5.0+dfsg.1-2UNKNOWN
Ubuntu22.04noarchroundcube-core< 1.5.0+dfsg.1-2UNKNOWN
Ubuntu22.04noarchroundcube-mysql< 1.5.0+dfsg.1-2UNKNOWN

OS	Version	Architecture	Package	Version	Filename
Ubuntu	23.10	noarch	roundcube	< 1.6.2+dfsg-1ubuntu0.2	UNKNOWN
Ubuntu	23.10	noarch	roundcube-core	< 1.6.2+dfsg-1ubuntu0.2	UNKNOWN
Ubuntu	23.10	noarch	roundcube-mysql	< 1.6.2+dfsg-1ubuntu0.2	UNKNOWN
Ubuntu	23.10	noarch	roundcube-pgsql	< 1.6.2+dfsg-1ubuntu0.2	UNKNOWN
Ubuntu	23.10	noarch	roundcube-plugins	< 1.6.2+dfsg-1ubuntu0.2	UNKNOWN
Ubuntu	23.10	noarch	roundcube-sqlite3	< 1.6.2+dfsg-1ubuntu0.2	UNKNOWN
Ubuntu	22.04	noarch	roundcube	< 1.5.0+dfsg.1-2ubuntu0.1~esm3	UNKNOWN
Ubuntu	22.04	noarch	roundcube	< 1.5.0+dfsg.1-2	UNKNOWN
Ubuntu	22.04	noarch	roundcube-core	< 1.5.0+dfsg.1-2	UNKNOWN
Ubuntu	22.04	noarch	roundcube-mysql	< 1.5.0+dfsg.1-2	UNKNOWN