Summary
It was discovered that Roundcube Webmail incorrectly handled sanitization in
the message_body function. A remote attacker could possibly use this issue to
send and receive emails as another user.
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · Pro 24.04 LTS Pro:24.04:LTS | roundcube | 1.6.6+dfsg-2ubuntu0.1+esm1 |
Vulnerabilities 1
-
Critical 9.3
A Cross-Site Scripting vulnerability in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to ste…
KEV Jun 9, 2025
References
-
report
https://ubuntu.com/security/CVE-2024-42009