Alerts This Week
Warning Icon 1 923
Alerts This Week
Warning Icon 1 923

openSUSE: 2023:0345-1 Important: RoundcubeMail Cross-Site Scripting Issue

opensuse
Calendar Grey November 2, 2023
Dist Opensuse Esm H88
OpenSUSE Security Patch for roundcubemail - Addresses critical cross-site scripting flaw.
An update that fixes one vulnerability is now available

Description

This update for roundcubemail fixes the following issues:

Update to version 1.6.4 (boo#1216429):

* CVE-2023-5631: Fix cross-site scripting vulnerability in handling of SVG

in HTML messages

* Fix PHP8 warnings

* Fix default 'mime.types' path on Windows

* Managesieve: Fix javascript error when relational or spamtest extension

is not enabled

Topics%20covered

Topics Covered

security advisory cross-site scripting security fix important update openSUSE roundcubemail

Patch

Patch Instructions:

To install this openSUSE Security Update use the SUSE recommended installation methods

like YaST online_update or "zypper patch".

Alternatively you can run the command listed for your product:

- openSUSE Backports SLE-15-SP5:

zypper in -t patch openSUSE-2023-345=1

Package List

- openSUSE Backports SLE-15-SP5 (noarch):

roundcubemail-1.6.4-bp155.2.6.1

References

https://www.suse.com/security/cve/CVE-2023-5631.html

https://bugzilla.suse.com/1216429

Severity
important
Lowest
Low
Medium
High
Critical

Announcement ID: openSUSE-SU-2023:0345-1
Rating: important
Affected Products: openSUSE Backports SLE-15-SP5 .

Topics%20covered

Topics Covered

security advisory cross-site scripting security fix important update openSUSE roundcubemail

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here