PT-2016-5836 · Roundcube+2 · Roundcube Webmail+2

Thomascube · Published 2016-04-22 · Updated 2026-03-30 · CVE-2016-4069

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Roundcube Webmail versions prior to 1.1.5

Description A cross-site request forgery (CSRF) issue allows remote attackers to hijack user authentication for requests that download attachments, potentially causing a denial of service due to disk consumption.

Recommendations For versions prior to 1.1.5, update to version 1.1.5 or later to resolve the issue.

Fix

DoS

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

ALT-PU-2016-1365

CVE-2016-4069

DLA-613-1

MGASA-2016-0155

USN-8132-1

Affected Products

Alt Linux

Roundcube Webmail

Ubuntu

References · 32

• https://github.com/roundcube/roundcubemail/commit/699af1e5206ed9114322adaa3c25c1c969640a53 · Patch
• https://github.com/roundcube/roundcubemail/commit/4a408843b0ef816daf70a472a02b78cd6073a4d5 · Patch
• https://osv.dev/vulnerability/MGASA-2016-0155 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2016-4069 · Security Note
• https://ubuntu.com/security/notices/USN-8132-1 · Vendor Advisory
• http://lists.opensuse.org/opensuse-updates/2016-08/msg00079.html · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-4069 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2016-4069 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-6820 · Vendor Advisory
• https://osv.dev/vulnerability/USN-8132-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-4068 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2016-0155.html · Security Note
• https://ubuntu.com/security/CVE-2017-8114 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-19205 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2016-4069 · Vendor Advisory