Description
steps/utils/modcss.inc in Roundcube Webmail before 0.5.1 does not properly verify that a request is an expected request for an external Cascading Style Sheets (CSS) stylesheet, which allows remote authenticated users to trigger arbitrary outbound TCP connections from the server, and possibly obtain sensitive information, via a crafted request.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | roundcube | 0.5.1-1 | — |
| Debian 13 | roundcube | 0.5.1-1 | — |
| Debian 12 | roundcube | 0.5.1-1 | — |
References
- [oss-security] 20110324 CVE request: roundcube < 0.5.1 CSRF mailing-list
- 44050 third-party-advisory
- [oss-security] 20110324 Re: CVE request: roundcube < 0.5.1 CSRF mailing-list
- roundcube-modcss-security-bypass(66613) vdb-entry
- [oss-security] 20110404 Re: CVE request: roundcube < 0.5.1 CSRF mailing-list
- http://trac.roundcube.net/wiki/Changelog
- http://trac.roundcube.net/changeset/4488