PT-2016-5836 · Roundcube+2 · Roundcube Webmail+2

Thomascube · Publicado 2016-04-22 · Atualizado 2026-03-30 · CVE-2016-4069

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Roundcube Webmail versions prior to 1.1.5

Description A cross-site request forgery (CSRF) issue allows remote attackers to hijack user authentication for requests that download attachments, potentially causing a denial of service due to disk consumption.

Recommendations For versions prior to 1.1.5, update to version 1.1.5 or later to resolve the issue.

Correção

DoS

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

ALT-PU-2016-1365

CVE-2016-4069

DLA-613-1

MGASA-2016-0155

USN-8132-1

Produtos afetados

Alt Linux

Roundcube Webmail

Ubuntu

Referências · 32

• https://github.com/roundcube/roundcubemail/commit/699af1e5206ed9114322adaa3c25c1c969640a53 · Correção
• https://github.com/roundcube/roundcubemail/issues/4957 · Nota
• https://github.com/roundcube/roundcubemail/releases/tag/1.1.5 · Nota
• https://github.com/roundcube/roundcubemail/wiki/Changelog#release-115 · Nota
• https://github.com/roundcube/roundcubemail/releases/tag/1.0.9 · Nota
• https://github.com/roundcube/roundcubemail/commit/4a408843b0ef816daf70a472a02b78cd6073a4d5 · Correção
• https://osv.dev/vulnerability/MGASA-2016-0155 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2016-4069 · Nota de Segurança
• http://openwall.com/lists/oss-security/2016/04/23/3 · Nota
• https://ubuntu.com/security/notices/USN-8132-1 · Aviso do Fabricante
• http://securityfocus.com/bid/92654 · Nota
• http://lists.opensuse.org/opensuse-updates/2016-08/msg00079.html · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2016/04/23/4 · Nota
• https://ubuntu.com/security/CVE-2016-4069 · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2016-4069 · Aviso do Fabricante