Skip to content
OpenAdvisories
Medium 2 exploited CVEs USN-6848-1 4 CVEs

roundcube vulnerabilities

Published Jun 25, 2024 · Updated Jun 25, 2026

Ecosystem: Ubuntu

Summary

Matthieu Faou and Denys Klymenko discovered that Roundcube incorrectly
handled certain SVG images. A remote attacker could possibly use this
issue to load arbitrary JavaScript code. This issue only affected Ubuntu
18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS and Ubuntu 23.10.
(CVE-2023-5631)

Rene Rehme discovered that Roundcube incorrectly handled certain headers.
A remote attacker could possibly use this issue to load arbitrary
JavaScript code. This issue only affected Ubuntu 20.04 LTS,
Ubuntu 22.04 LTS and Ubuntu 23.10. (CVE-2023-47272)

Valentin T. and Lutz Wolf discovered that Roundcube incorrectly handled
certain SVG images. A remote attacker could possibly use this issue to
load arbitrary JavaScript code. This issue only affected Ubuntu 18.04 LTS,
Ubuntu 20.04 LTS, Ubuntu 22.04 LTS and Ubuntu 23.10. (CVE-2024-37383)

Huy Nguyễn Phạm Nhật discovered that Roundcube incorrectly handled
certain fields in user preferences. A remote attacker could possibly use
this issue to load arbitrary JavaScript code. (CVE-2024-37384)

Fixed packages 4

ReleasePackageFixed in
Ubuntu · Pro 16.04 LTS Pro:16.04:LTS roundcube 1.2~beta+dfsg.1-0ubuntu1+esm4
Ubuntu · Pro 18.04 LTS Pro:18.04:LTS roundcube 1.3.6+dfsg.1-1ubuntu0.1~esm4
Ubuntu · Pro 20.04 LTS Pro:20.04:LTS roundcube 1.4.3+dfsg.1-1ubuntu0.1~esm4
Ubuntu · Pro 22.04 LTS Pro:22.04:LTS roundcube 1.5.0+dfsg.1-2ubuntu0.1~esm3

Vulnerabilities 4

  • Medium 6.1
    CVE-2023-5631 Exploited EPSS 76%

    Stored XSS vulnerability in Roundcube

    Roundcube before 1.4.15, 1.5.x before 1.5.5, and 1.6.x before 1.6.4 allows stored XSS via an HTML e-mail message with a crafted SVG document because of program/lib/Roundcube/rcube_washtml.php behavior. This could allow a remote attacker to load arbitrary Java…

    Roundcube Roundcubemail roundcube roundcube Debian Ubuntu
    KEV Oct 26, 2023
  • Medium 6.1
    CVE-2024-37383 Exploited Public exploit EPSS 74%

    Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 allows XSS via SVG animate attributes.

    roundcube roundcube Debian Ubuntu
    KEV Oct 24, 2024
  • Medium 6.1
    CVE-2023-47272

    Roundcube 1.5.x before 1.5.6 and 1.6.x before 1.6.5 allows XSS via a Content-Type or Content-Disposition header (used f…

    roundcube roundcube Debian Ubuntu
  • Medium 6.1
    CVE-2024-37384

    Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 allows XSS via list columns from user preferences.

    roundcube roundcube Debian Ubuntu

References

  • report
    https://ubuntu.com/security/CVE-2023-5631
  • report
    https://ubuntu.com/security/CVE-2023-47272
  • report
    https://ubuntu.com/security/CVE-2024-37383
  • report
    https://ubuntu.com/security/CVE-2024-37384
  • report
    https://launchpad.net/bugs/2043396