Description
Cross-site scripting (XSS) vulnerability in program/steps/mail/func.inc in RoundCube Webmail before 0.8.0, when using the Larry skin, allows remote attackers to inject arbitrary web script or HTML via the email message subject.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | roundcubemail | 1.2.3-1.1 | openSUSE-SU-2024:10491-1 |
Advisories 1
- openSUSE-SU-2024:10491-1 roundcubemail-1.2.3-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- [oss-security] 20120820 Re: CVE-request: Roundcube XSS issues mailing-list
- http://www.securelist.com/en/advisories/50212
- http://sourceforge.net/projects/roundcubemail/files/roundcubemail/0.8.0/
- [oss-security] 20120820 Re: CVE-request: Roundcube XSS issues mailing-list
- [oss-security] 20120820 CVE-request: Roundcube XSS issues mailing-list
- http://trac.roundcube.net/ticket/1488519
- 50212 third-party-advisory