GLSA-201402-15 : Roundcube: Arbitrary code execution
High Nessus Plugin ID 72452
SynopsisThe remote Gentoo host is missing one or more security-related patches.
DescriptionThe remote host is affected by the vulnerability described in GLSA-201402-15 (Roundcube: Arbitrary code execution)
A vulnerability in steps/utils/save_pref.inc allows remote attackers to use the _session parameter to change configuration settings.
A remote attacker could possibly execute arbitrary code with the privileges of the process, inject SQL code, or read arbitrary files.
There is no known workaround at this time.
SolutionAll Roundcube 0.9 users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose '>=mail-client/roundcube-0.9.5' All Roundcube 0.8 users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose '>=mail-client/roundcube-0.8.7'