openSUSE Security Update : roundcubemail (openSUSE-SU-2015:0116-1)

This script is Copyright (C) 2015 Tenable Network Security, Inc.


Synopsis :

The remote openSUSE host is missing a security update.

Description :

roundcubemail was updated to 1.0.4 fixing bugs and security issues.

Changes :

- Disable TinyMCE contextmenu plugin as there are more
cons than pros in using it (#1490118)

- Fix bug where show_real_foldernames setting wasn't
honored on compose page (#1490153)

- Fix issue where Archive folder wasn't protected in
Folder Manager (#1490154)

- Fix compatibility with PHP 5.2. in rcube_imap_generic
(#1490115)

- Fix setting flags on servers with no PERMANENTFLAGS
response (#1490087)

- Fix regression in SHAA password generation in ldap
driver of password plugin (#1490094)

- Fix displaying of HTML messages with absolutely
positioned elements in Larry skin (#1490103)

- Fix font style display issue in HTML messages with
styled <span> elements (#1490101)

- Fix download of attachments that are part of TNEF
message (#1490091)

- Fix handling of uuencoded messages if messages_cache is
enabled (#1490108)

- Fix handling of base64-encoded attachments with extra
spaces (#1490111)

- Fix handling of UNKNOWN-CTE response, try do decode
content client-side (#1490046)

- Fix bug where creating subfolders in shared folders
wasn't possible without ACL extension (#1490113)

- Fix reply scrolling issue with text mode and start
message below the quote (#1490114)

- Fix possible issues in skin/skin_path config handling
(#1490125)

- Fix lack of delimiter for recipient addresses in
smtp_log (#1490150)

- Fix generation of Blowfish-based password hashes
(#1490184)

- Fix bugs where CSRF attacks were still possible on some
requests (CVE-2014-9587)

See also :

http://lists.opensuse.org/opensuse-updates/2015-01/msg00056.html
https://bugzilla.opensuse.org/show_bug.cgi?id=913095

Solution :

Update the affected roundcubemail package.

Risk factor :

Medium / CVSS Base Score : 6.8
(CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P)

Family: SuSE Local Security Checks

Nessus Plugin ID: 80989 ()

Bugtraq ID:

CVE ID: CVE-2014-9587

Ready to Amp Up Your Nessus Experience?

Get Nessus Professional to scan unlimited IPs, run compliance checks & more

Buy Nessus Professional Now