The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4415 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-4415-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                       Guilhem Moulin     December 18, 2025                             https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : roundcube     Version        : 1.4.15+dfsg.1-1+deb11u6     CVE ID         : CVE-2025-68460 CVE-2025-68461     Debian Bug     : 1122899

    Vulnerabilities were discovered in Roundcube, a skinnable AJAX based     webmail solution for IMAP servers, which might lead to privilege     escalation or information disclosure.

    CVE-2025-68460

        Information disclosure vulnerability in the HTML style sanitizer.

    CVE-2025-68461

        Cross-Site-Scripting (XSS) vulnerability via SVG's `<animate>` tag,         which could allow a remote attacker to load arbitrary JavaScript         code and might lead to privilege escalation or information         disclosure via malicious SVG document.

    For Debian 11 bullseye, these problems have been fixed in version     1.4.15+dfsg.1-1+deb11u6.

    We recommend that you upgrade your roundcube packages.

    For the detailed security status of roundcube please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/roundcube

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Debian dla-4415 : roundcube - security update

high Nessus Plugin ID 279110

Version 1.2

Version 1.1

Version 1.2 Feb 6, 2026, 5:01 PM IAVM reference STIG Severity (set to "I") Plugin Feed: 202602061701
Version 1.1 Dec 19, 2025, 2:41 AM New Plugin Feed: 202512190241