| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-Id: <E1UUKtI-00061F-Hq@titan.mandriva.com> Date: Mon, 22 Apr 2013 19:51:00 +0200 From: security@...driva.com To: full-disclosure@...ts.grok.org.uk Subject: [ MDVSA-2013:148 ] roundcubemail -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 _______________________________________________________________________ Mandriva Linux Security Advisory MDVSA-2013:148 http://www.mandriva.com/en/support/security/ _______________________________________________________________________ Package : roundcubemail Date : April 21, 2013 Affected: Enterprise Server 5.0 _______________________________________________________________________ Problem Description: Multiple vulnerabilities has been found and corrected in roundcubemail: Cross-site scripting (XSS) vulnerability in Roundcube Webmail 0.8.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the signature in an email (CVE-2012-4668). A local file inclusion flaw was found in the way RoundCube Webmail, a browser-based multilingual IMAP client, performed validation of the 'generic_message_footer' value provided via web user interface in certain circumstances. A remote attacker could issue a specially-crafted request that, when processed by RoundCube Webmail could allow an attacker to obtain arbitrary file on the system, accessible with the privileges of the user running RoundCube Webmail client (CVE-2013-1904). The updated packages have been patched and upgraded to the 0.7.4 version which is not affected by these issues. _______________________________________________________________________ References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1904 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4668 http://lists.roundcube.net/pipermail/dev/2013-March/022328.html http://downloads.sourceforge.net/project/roundcubemail/roundcubemail/0.7.3/README_0.7.3.txt http://downloads.sourceforge.net/project/roundcubemail/roundcubemail/0.7.4/README_0.7.4.txt _______________________________________________________________________ Updated Packages: Mandriva Enterprise Server 5: 8115fa1ac36413ca54ead740972774b1 mes5/i586/roundcubemail-0.7.4-0.1mdvmes5.2.noarch.rpm 619c3f956f5220859a9ac4f9018d5434 mes5/SRPMS/roundcubemail-0.7.4-0.1mdvmes5.2.src.rpm Mandriva Enterprise Server 5/X86_64: 8cb680beb0aa440f9b4cba12cad146dc mes5/x86_64/roundcubemail-0.7.4-0.1mdvmes5.2.noarch.rpm 619c3f956f5220859a9ac4f9018d5434 mes5/SRPMS/roundcubemail-0.7.4-0.1mdvmes5.2.src.rpm _______________________________________________________________________ To upgrade automatically use MandrivaUpdate or urpmi. The verification of md5 checksums and GPG signatures is performed automatically for you. All packages are signed by Mandriva for security. You can obtain the GPG public key of the Mandriva Security Team by executing: gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98 You can view other update advisories for Mandriva Linux at: http://www.mandriva.com/en/support/security/advisories/ If you want to report vulnerabilities, please contact security_(at)_mandriva.com _______________________________________________________________________ Type Bits/KeyID Date User ID pub 1024D/22458A98 2000-07-10 Mandriva Security Team <security*mandriva.com> -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (GNU/Linux) iD8DBQFRdUzSmqjQ0CJFipgRApydAJ95cjdhD4ruMF+v3azThPTPXGCSaQCeNd8R BHNhq+JpSSbtOyqwbGXRGg4= =uHzE -----END PGP SIGNATURE----- _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Powered by blists - more mailing lists