The bbcode plugin in TinyMCE 3.5.8 does not properly enforce the TinyMCE security policy for the (1) encoding directive and (2) valid_elements attribute, which allows attackers to conduct cross-site scripting (XSS) attacks via application-specific vectors, as demonstrated using a textarea element.

This update provides Roundcube 1.0.4. This is a stable security update: the security fix is described by upstream as 'Fix possible CSRF attacks to some address book operations as well as to the ACL and Managesieve plugins.' More details on the update are available at http://roundcube.net/news/2014/12/18/update-1.0.4-released/ . The update should apply without any special handling by the system administrator.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Add patch for CVE-2012-4230.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
80378	Fedora 20 : roundcubemail-1.0.4-2.fc20 (2014-17461)	Nessus	Fedora Local Security Checks	medium
80377	Fedora 21 : roundcubemail-1.0.4-2.fc21 (2014-17450)	Nessus	Fedora Local Security Checks	medium
80144	Fedora 21 : sagemath-6.3-5.fc21 (2014-16756)	Nessus	Fedora Local Security Checks	medium
80141	Fedora 20 : sagemath-6.1.1-6.fc20 (2014-16667)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2012-4230

medium

Tenable Plugins

medium

medium

medium

medium