CVE-2015-2181
Multiple buffer overflows in the DBMail driver in the Password plugin in Roundcube before 1.1.0...
Multiple buffer overflows in the DBMail driver in the Password plugin in Roundcube before 1.1.0 allow remote attackers to have unspecified impact via the (1) password or (2) username.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Multiple buffer overflows in the DBMail driver in the Password plugin in Roundcube before 1.1.0 allow remote attackers to have unspecified impact via the (1) password or (2) username.
- Record
CVE-2015-2181- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 6.5 Medium
AV:N/AC:L/Au:S/C:P/I:P/A:P - Weakness
- CWE-119
- Updated
- 2026-11-02
CVE List No score
Multiple buffer overflows in the DBMail driver in the Password plugin in Roundcube before 1.1.0 allow remote attackers to have unspecified impact via the (1) password or (2) username.
- Record
CVE-2015-2181- Updated
- 2026-11-02
EUVDEUVD-2015-2288 No score
Multiple buffer overflows in the DBMail driver in the Password plugin in Roundcube before 1.1.0 allow remote attackers to have unspecified impact via the (1) password or (2) username.
- Record
EUVD-2015-2288- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-v2gp-p8mp-5q72
Multiple buffer overflows in the DBMail driver in the Password plugin in Roundcube before 1.1.0...
Multiple buffer overflows in the DBMail driver in the Password plugin in Roundcube before 1.1.0 allow remote attackers to have unspecified impact via the (1) password or (2) username.
- Record
GHSA-v2gp-p8mp-5q72- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-119
- Updated
- 2026-11-02
OSV
Multiple buffer overflows in the DBMail driver in the Password plugin in Roundcube before 1.1.0 allow remote attackers to have unspecified impact via the (1) password or (2) username.
- Record
CVE-2015-2181- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2015-2181
Multiple buffer overflows in the DBMail driver in the Password plugin in Roundcube before 1.1.0 allow remote attackers to have unspecified impact via the (1) password or (2) username.
- Record
DEBIAN-CVE-2015-2181- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2015-2181
Multiple buffer overflows in the DBMail driver in the Password plugin in Roundcube before 1.1.0 allow remote attackers to have unspecified impact via the (1) password or (2) username.
- Record
UBUNTU-CVE-2015-2181- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVMGASA-2015-0400 No score
Updated roundcubemail package fixes security vulnerabilities
Multiple security issues in the DBMail driver for the password plugin, including buffer overflows (CVE-2015-2181) and the ability for a remote attacker to execute arbitrary shell commands as root (CVE-2015-2180).
An authenticated user can download arbitrary files from the web server that the web server process has read access to, by uploading a vCard with a specially crafted POST (CVE-2015-5382).
The roundcubemail package has been updated to version 1.0.6, fixing these issues and several other bugs, however the installer is currently known to be broken.
- Record
MGASA-2015-0400- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10491-1 No score
roundcubemail-1.2.3-1.1 on GA media
These are all security issues fixed in the roundcubemail-1.2.3-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10491-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
roundcubeDebian:12 |
before 1.1.1+dfsg.1-2 | 1.1.1+dfsg.1-2 |
roundcubeDebian:13 |
before 1.1.1+dfsg.1-2 | 1.1.1+dfsg.1-2 |
roundcubeDebian:14 |
before 1.1.1+dfsg.1-2 | 1.1.1+dfsg.1-2 |
roundcubemailMageia:5 From an advisory covering 3 CVEs |
before 1.0.6-1.1.mga5 | 1.0.6-1.1.mga5 |
roundcubemailopenSUSE:Tumbleweed From an advisory covering 7 CVEs |
before 1.2.3-1.1 | 1.2.3-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2015-2181 is a high vulnerability (CVSS 8.8) in Roundcube Webmail, published October 14, 2015. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.87%, the 86th percentile. Fixed in roundcube 1.1.1+dfsg.1-2.
References
securityfocus.com/bid/96391
github.com/roundcube/roundcubemail/issues/4757
nvd.nist.gov/vuln/detail/CVE-2015-2181
security-tracker.debian.org/tracker/CVE-2015-2181
advisories.mageia.org/MGASA-2015-0400.html
Show 16 moreShow less
bugs.mageia.org/show_bug.cgi?id=16249
openwall.com/lists/oss-security/2015/07/07/2
trac.roundcube.net/ticket/1490261
lists.opensuse.org/opensuse-updates/2015-06/msg00062.html
ubuntu.com/security/CVE-2015-2181
cve.org/CVERecord?id=CVE-2015-2181
suse.com/security/cve/CVE-2012-3507