Multiple vulnerabilities have been discovered in Roundcube, the worst of which could lead to execution of arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| mail-client/roundcube | * | < 1.6.11 | >= 1.6.11 |
Free and open source webmail software for the masses, written in PHP.
Multiple vulnerabilities have been discovered in Roundcube. Please review the CVE identifiers referenced below for details.
Please review the referenced CVE identifiers for details.
There is no known workaround at this time.
All Roundcube users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=mail-client/roundcube-1.6.11"
A flaw in Roundcube's handling of configuration files may allow arbitrary code execution, amongst other vulnerabilities.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| mail-client/roundcube | * | < 1.4.4:1.4.4, < 1.3.11:1.3.11 | >= 1.4.4:1.4.4, >= 1.3.11:1.3.11 |
Free and open source webmail software for the masses, written in PHP.
Multiple vulnerabilities have been discovered in Roundcube. Please review the CVE identifiers referenced below for details.
Please review the referenced CVE identifiers for details.
There is no known workaround at this time.
All Roundcube 1.4.x users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=mail-client/roundcube-1.4.4"
All Roundcube 1.3.x users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=mail-client/roundcube-1.3.11"
A vulnerability in RoundCube may allow authenticated users to bypass security restrictions.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| mail-client/roundcube | * | < 1.2.5 | >= 1.2.5 |
Free and open source webmail software for the masses, written in PHP.
Authenticated users can arbitrarily reset passwords due to a problem caused by an improperly restricted exec call in the virtualmin and sasl drivers of the password plugin.
Authenticated users can bypass security restrictions and elevate privileges.
There is no known workaround at this time.
All RoundCube users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=mail-client/roundcube-1.2.5"
A vulnerability in Roundcube could potentially lead to arbitrary code execution.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| mail-client/roundcube | * | < 1.2.3 | >= 1.2.3 |
Free and open source webmail software for the masses, written in PHP.
Roundcube, when no SMTP server is configured and the sendmail program is enabled, does not properly restrict the use of custom envelope-from addresses on the sendmail command line.
An authenticated remote attacker could possibly execute arbitrary code with the privileges of the process, or cause a Denial of Service condition.
Don’t use a MTA (Mail Transfer Agent) in conjunction with Roundcube which implements sendmail’s “-O” or “-X” parameter, or configure Roundcube to use a SMTP server as recommended by upstream.
All Roundcube users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=mail-client/roundcube-1.2.3"
Multiple vulnerabilities have been found in Roundcube allowing remote authenticated users to execute arbitrary code, inject arbitrary web scripts, and perform cross-site scripting (XSS).
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| mail-client/roundcube | * | < 1.1.4 | >= 1.1.4 |
Free and open source webmail software for the masses, written in PHP.
Remote authenticated users with certain permissions can read arbitrary files or possibly execute arbitrary code via .. in the _skin parameter to index.php. Additionally, a cross-site scripting (XSS) vulnerability in program/js/app.js allows remote authenticated users to inject arbitrary web script or HTML via the file name in a drag-n-drop file upload.
A remote authenticated user could possibly execute arbitrary code with the privileges of the process, inject arbitrary web scripts or HTML, read arbitrary files, or perform XSS.
There is no known workaround at this time.
All Roundcube users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=mail-client/roundcube-1.1.4”
A vulnerability in Roundcube could result in arbitrary code execution, SQL injection, or reading of arbitrary files.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| mail-client/roundcube | * | < 0.9.5 | >= 0.9.5, >= 0.8.7 (revision) |
Roundcube is a browser-based multilingual IMAP client with an application-like user interface.
A vulnerability in steps/utils/save_pref.inc allows remote attackers to use the _session parameter to change configuration settings.
A remote attacker could possibly execute arbitrary code with the privileges of the process, inject SQL code, or read arbitrary files.
There is no known workaround at this time.
All Roundcube 0.9 users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=mail-client/roundcube-0.9.5"
All Roundcube 0.8 users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=mail-client/roundcube-0.8.7"