[Pkg-roundcube-maintainers] Bug#721592: roundcube: CVE-2013-5645
carnil at debian.org
Mon Sep 2 06:31:27 UTC 2013
Tags: security upstream patch fixed-upstream
the following vulnerability was published for roundcube.
| Multiple cross-site scripting (XSS) vulnerabilities in Roundcube
| webmail before 0.9.3 allow user-assisted remote attackers to inject
| arbitrary web script or HTML via the body of a message visited in (1)
| new or (2) draft mode, related to compose.inc; and (3) might allow
| remote authenticated users to inject arbitrary web script or HTML via
| an HTML signature, related to save_identity.inc.
If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
For further information see:
Please adjust the affected versions in the BTS as needed. At least
0.9.2 looks affected.
More information about the Pkg-roundcube-maintainers