-------------------------------------------------------------------------
Debian LTS Advisory DLA-3835-1                debian-lts@lists.debian.org
https://www.debian.org/lts/security/                       Guilhem Moulin
June 17, 2024                                 https://wiki.debian.org/LTS
-------------------------------------------------------------------------

Package        : roundcube
Version        : 1.3.17+dfsg.1-1~deb10u6
CVE ID         : CVE-2024-37383 CVE-2024-37384
Debian Bug     : 1071474

Cross-site scripting (XSS) vulnerabilities were discovered in Roundcube,
a skinnable AJAX based webmail solution for IMAP servers, which could
allow a remote attacker to load arbitrary JavaScript code and might lead
to privilege escalation or information disclosure.

CVE-2024-37383

    Valentin T. and Lutz Wolf of CrowdStrike discovered that Roundcube
    allows XSS via SVG animate attributes.

CVE-2024-37384

    Huy Nguyễn Phạm Nhật discovered that Roundcube allows XSS via list
    columns from user preferences.

For Debian 10 buster, these problems have been fixed in version
1.3.17+dfsg.1-1~deb10u6.

We recommend that you upgrade your roundcube packages.

For the detailed security status of roundcube please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/roundcube

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS

Debian LTS: DLA-3835-1: roundcube Security Advisory Updates

June 17, 2024
Cross-site scripting (XSS) vulnerabilities were discovered in Roundcube, a skinnable AJAX based webmail solution for IMAP servers, which could allow a remote attacker to load arbit...

Summary


Cross-site scripting (XSS) vulnerabilities were discovered in Roundcube,
a skinnable AJAX based webmail solution for IMAP servers, which could
allow a remote attacker to load arbitrary JavaScript code and might lead
to privilege escalation or information disclosure.

CVE-2024-37383

Valentin T. and Lutz Wolf of CrowdStrike discovered that Roundcube
allows XSS via SVG animate attributes.

CVE-2024-37384

Huy Nguyễn Phạm Nhật discovered that Roundcube allows XSS via list
columns from user preferences.

For Debian 10 buster, these problems have been fixed in version
1.3.17+dfsg.1-1~deb10u6.

We recommend that you upgrade your roundcube packages.

For the detailed security status of roundcube please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/roundcube

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS


Severity
Package : roundcube
Version : 1.3.17+dfsg.1-1~deb10u6
CVE ID : CVE-2024-37383 CVE-2024-37384
Debian Bug : 1071474

Related News

8.Locks HexConnections CodeGlobe Esm H170
2 - 4 min read
Canonical has made headlines with its groundbreaking long-term support (LTS) service offering to extend far beyond Ubuntu deb packages, promising 12
14.Lock Code WorldMap Esm H170
2 - 4 min read
Government agencies are drawing attention to an issue plaguing open-source communities: memory-unsafe languages. A study entitled " Exploring Memory
11.Locks IsometricPattern Esm H170
2 - 3 min read
Cybersecurity threats continue to emerge regularly, and Promon's security team recently identified one such novel threat, Snowblind. This malware
32.Lock Code Circular Esm H170
2 - 4 min read
The Cybersecurity and Infrastructure Security Agency (CISA) recently added a new Linux kernel privilege escalation bug ( CVE-2024-1086 ) to its
6.EmailConnection Touch Esm H170
2 - 3 min read
Recent security updates for Ubuntu and Debian have been released to address vulnerabilities in Thunderbird, the popular open-source mail and
20.Lock AbstractDigital Circular Esm H170
2 - 3 min read
Google has released fixes for a high-severity Chromium security flaw ( CVE-2024-5274 ) impacting its widely used Chrome browser and other
20.Lock AbstractDigital Circular Esm H170
2 - 4 min read
The recent discovery of a backdoor in Linux's xz compression tool has shed light on cybercriminals' ingenious methods of gaining entry and remaining
19.Laptop Bed Esm H170
2 - 4 min read
Wordfence security researchers recently shed light on an infamous supply chain attack that may have affected as many as 36,000 WordPress websites.

Get the Latest News & Insights

Sign up to get the latest security news affecting Linux and open source delivered straight to your inbox.

© 2024 Guardian Digital, Inc All Rights Reserved