_______________________________________________________________________ Mandriva Linux Security Advisory MDVSA-2013:148 http://www.mandriva.com/en/support/security/ _______________________________________________________________________ Package : roundcubemail Date : April 21, 2013 Affected: Enterprise Server 5.0 _______________________________________________________________________ Problem Description: Multiple vulnerabilities has been found and corrected in roundcubemail: Cross-site scripting (XSS) vulnerability in Roundcube Webmail 0.8.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the signature in an email (CVE-2012-4668). A local file inclusion flaw was found in the way RoundCube Webmail, a browser-based multilingual IMAP client, performed validation of the 'generic_message_footer' value provided via web user interface in certain circumstances. A remote attacker could issue a specially-crafted request that, when processed by RoundCube Webmail could allow an attacker to obtain arbitrary file on the system, accessible with the privileges of the user running RoundCube Webmail client (CVE-2013-1904). The updated packages have been patched and upgraded to the 0.7.4 version which is not affected by these issues. _______________________________________________________________________ References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1904 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4668 http://lists.roundcube.net/pipermail/dev/2013-March/022328.html http://downloads.sourceforge.net/project/roundcubemail/roundcubemail/0.7.3/README_0. 7.3.txt http://downloads.sourceforge.net/project/roundcubemail/roundcubemail/0.7.4/README_0. 7.4.txt _______________________________________________________________________ Updated Packages: Mandriva Enterprise Server 5: 8115fa1ac36413ca54ead740972774b1 mes5/i586/roundcubemail-0.7.4-0.1mdvmes5.2.noarch.rpm 619c3f956f5220859a9ac4f9018d5434 mes5/SRPMS/roundcubemail-0.7.4-0.1mdvmes5.2.src.rpm Mandriva Enterprise Server 5/X86_64: 8cb680beb0aa440f9b4cba12cad146dc mes5/x86_64/roundcubemail-0.7.4-0.1mdvmes5.2.noarch.rpm 619c3f956f5220859a9ac4f9018d5434 mes5/SRPMS/roundcubemail-0.7.4-0.1mdvmes5.2.src.rpm _______________________________________________________________________ To upgrade automatically use MandrivaUpdate or urpmi. The verification of md5 checksums and GPG signatures is performed automatically for you. All packages are signed by Mandriva for security. You can obtain the GPG public key of the Mandriva Security Team by executing: gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98 You can view other update advisories for Mandriva Linux at: http://www.mandriva.com/en/support/security/advisories/ If you want to report vulnerabilities, please contact security_(at)_mandriva.com _______________________________________________________________________ Type Bits/KeyID Date User ID pub 1024D/22458A98 2000-07-10 Mandriva Security Team <security*mandriva.com>
By subscribing to our early morning news update, you will receive a daily digest of the latest security news published on Help Net Security.
With over 500 issues so far, reading our newsletter every Monday morning will keep you up-to-date with security risks out there.