Roundcube: Mehrere Schwachstellen

Summary

Product

Vulnerabilities 3

• Medium 6.1
  CVE-2024-37383 Exploited Public exploit EPSS 74%

  Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 allows XSS via SVG animate attributes.

  roundcube roundcube Debian Ubuntu
  Jun 7, 2024

  KEV Oct 24, 2024
• Critical 9.8
  CVE-2024-37385

  Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 on Windows allows command injection via im_convert_path and im_id…

  Jun 7, 2024
• Medium 6.1
  CVE-2024-37384

  Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 allows XSS via list columns from user preferences.

  roundcube roundcube Debian Ubuntu
  Jun 7, 2024

Revision history

1. 2024-10-21 #5

   Aktive Ausnutzung gemeldet

2. 2024-06-25 #4

   Neue Updates von Ubuntu aufgenommen

3. 2024-06-18 #3

   Neue Updates von Debian aufgenommen

4. 2024-06-17 #2

   Neue Updates von Debian aufgenommen

5. 2024-06-06 #1

   Initiale Fassung

References

• Roundcube Webmail 1.5.7 vom 2024-06-06
  https://github.com/roundcube/roundcubemail/releases/tag/1.5.7
• Roundcube Webmail 1.6.7 vom 2024-06-06
  https://github.com/roundcube/roundcubemail/releases/tag/1.6.7
• Red Hat Bugtracker #2290826 vom 2024-06-06
  https://bugzilla.redhat.com/show_bug.cgi?id=2290826
• Red Hat Bugtracker #2290830 vom 2024-06-06
  https://bugzilla.redhat.com/show_bug.cgi?id=2290830
• Red Hat Bugtracker #2290828 vom 2024-06-06
  https://bugzilla.redhat.com/show_bug.cgi?id=2290828
• Debian Security Advisory DLA-3835 vom 2024-06-17
  https://lists.debian.org/debian-lts-announce/2024/06/msg00008.html
• Debian Security Advisory DSA-5714 vom 2024-06-18
  https://lists.debian.org/debian-security-announce/2024/msg00124.html
• Ubuntu Security Notice USN-6848-1 vom 2024-06-26
  https://ubuntu.com/security/notices/USN-6848-1
• The Hackernews vom 2024-10-21
  https://thehackernews.com/2024/10/hackers-exploit-roundcube-webmail-xss.html