Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2016-4552. Reason: This candidate is a reservation duplicate of CVE-2016-4552. Notes: All CVE users should reference CVE-2016-4552 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage

This update for roundcubemail fixes the following issues :

  - A maliciously crafted email could cause untrusted code     to be executed (cross site scripting using $lt;area     href=javascript:...>) (boo#982003, CVE-2016-5103)

  - Avoid HTML styles that could cause potential click     jacking (boo#1001856)

  - A maliciously crafted FROM value could cause extra     parameters to be passed to the sendmail command     (boo#1012493)

  - Avoid sending completely empty text parts for     multipart/alternative messages

  - Don't create multipart/alternative messages with empty     text/plain part

  - Improved validation of FROM argument when sending mails

roundcubemail was updated to version 1.1.7 and fixes the following issues :

  - Update to 1.1.7

  - A maliciously crafted FROM value could cause extra     parameters to be passed to the sendmail command     (boo#1012493)

  - A maliciously crafted email could cause untrusted code     to be executed (cross site scripting using $lt;area     href=javascript:...>) (boo#982003, CVE-2016-5103)

  - Avoid HTML styles that could cause potential click     jacking (boo#1001856)

  - Update to 1.1.5

  - Fixed security issue in DBMail driver of password plugin     (CVE-2015-2181, boo#976988)

Roundcube reports :

Fix XSS issue in href attribute on area tag (#5240).

ID	Name	Product	Family	Severity
96247	openSUSE Security Update : roundcubemail (openSUSE-2016-1533)	Nessus	SuSE Local Security Checks	high
95700	openSUSE Security Update : roundcubemail (openSUSE-2016-1419)	Nessus	SuSE Local Security Checks	high
95643	openSUSE Security Update : roundcubemail (openSUSE-2016-1418)	Nessus	SuSE Local Security Checks	high
91554	FreeBSD : roundcube -- XSS vulnerability (97e86d10-2ea7-11e6-ae88-002590263bf5)	Nessus	FreeBSD Local Security Checks	high

Detections

Analytics

CVE-2016-5103

No Score

Tenable Plugins

high

high

high

high