Cross-site scripting (XSS) vulnerability in Roundcube Webmail before 1.0.9 and 1.1.x before 1.1.5 allows remote attackers to inject arbitrary web script or HTML via a crafted SVG, a different vulnerability than CVE-2015-8864.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Cross-site scripting (XSS) vulnerability in Roundcube Webmail before 1.0.9 and 1.1.x before 1.1.5 allows     remote attackers to inject arbitrary web script or HTML via a crafted SVG, a different vulnerability than     CVE-2015-8864. (CVE-2016-4068)

Note that Nessus relies on the presence of the package as reported by the vendor.

**Release 1.1.5** * Plugin API: Added html2text hook * Plugin API:
Added addressbook_export hook * Fix missing emoticons on html-to-text conversion * Fix random 'access to this resource is secured against CSRF' message at logout (#4956) * Fix missing language name in 'Add to Dictionary' request in HTML mode (#4951) * Enable use of TLSv1.1 and TLSv1.2 for IMAP (#4955) * Fix XSS issue in SVG images handling (#4949) * Fix (again) security issue in DBMail driver of password plugin (CVE-2015-2181) (#4958) * Fix bug in long recipients list parsing for cases where recipient name contained @-char (#4964)

  - Fix additional_message_headers plugin compatibility with     Mail_Mime >= 1.9 (#4966) * Hide DSN option in     Preferences when smtp_server is not used (#4967)

  - Protect download urls against CSRF using unique request     tokens (#4957) * newmail_notifier Plugin: Refactored     desktop notifications * Fix so contactlist_fields option     can be set via config file * Fix so SPECIAL-USE     assignments are forced only until user sets special     folders (#4782) * Fix performance in reverting order of     THREAD result * Fix converting mail addresses with www.
    into mailto links (#5197)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
253949	Linux Distros Unpatched Vulnerability : CVE-2016-4068	Nessus	Misc.	medium
90971	Fedora 24 : roundcubemail-1.1.5-1.fc24 (2016-aff691237e)	Nessus	Fedora Local Security Checks	high
90815	Fedora 22 : roundcubemail-1.1.5-1.fc22 (2016-a9c8f9dcff)	Nessus	Fedora Local Security Checks	high
90813	Fedora 23 : roundcubemail-1.1.5-1.fc23 (2016-69eb7f9fb2)	Nessus	Fedora Local Security Checks	high

Detections

Analytics

CVE-2016-4068

medium

Tenable Plugins

medium

high

high

high