Skip to content
OpenAdvisories
Medium 1 exploited CVE USN-6654-1 1 CVE

roundcube vulnerability

Published Feb 26, 2024 · Updated Jun 25, 2026

Ecosystem: Ubuntu

Summary

It was discovered that Roundcube Webmail incorrectly sanitized characters
in the linkrefs text messages. An attacker could possibly use this issue to
execute a cross-site scripting (XSS) attack. (CVE-2023-43770)

Fixed packages 4

ReleasePackageFixed in
Ubuntu · Pro 16.04 LTS Pro:16.04:LTS roundcube 1.2~beta+dfsg.1-0ubuntu1+esm3
Ubuntu · Pro 18.04 LTS Pro:18.04:LTS roundcube 1.3.6+dfsg.1-1ubuntu0.1~esm3
Ubuntu · Pro 20.04 LTS Pro:20.04:LTS roundcube 1.4.3+dfsg.1-1ubuntu0.1~esm3
Ubuntu · Pro 22.04 LTS Pro:22.04:LTS roundcube 1.5.0+dfsg.1-2ubuntu0.1~esm2

Vulnerabilities 1

  • Medium 6.1
    CVE-2023-43770 Exploited Public exploit EPSS 64%

    Roundcube before 1.4.14, 1.5.x before 1.5.4, and 1.6.x before 1.6.3 allows XSS via text/plain e-mail messages with craf…

    roundcube roundcube Debian Ubuntu
    KEV Feb 12, 2024

References

  • report
    https://ubuntu.com/security/CVE-2023-43770