PT-2024-41052 · Unknown · Roundcube Webmail

Published 2024-05-25 · Updated 2024-05-25

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions Roundcube Webmail versions 1.6.x

Description The issue concerns several security problems, including cross-site scripting (XSS) vulnerabilities in handling SVG animate attributes and list columns from user preferences, as well as a command injection vulnerability via crafted im convert path/im identify path on Windows. These vulnerabilities were reported by Valentin T. and Lutz Wolf of CrowdStrike, and Huy Nguyễn Phạm Nhật.

Recommendations For Roundcube Webmail version 1.6.x, update to the latest stable version 1.6 to resolve the issues. Before updating, ensure to backup your data.

Related Identifiers

MGASA-2024-0193

Affected Products

Roundcube Webmail

References · 4

• https://osv.dev/vulnerability/MGASA-2024-0193 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2024-0193.html · Security Note
• https://github.com/roundcube/roundcubemail/releases/tag/1.6.7 · Note
• https://bugs.mageia.org/show_bug.cgi?id=33229 · Note