Every CVE Search/ Get API key

CVE-2024-42010

mod_css_styles in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a insufficiently filters...

7.5 HighFix available

mod_css_styles in Roundcube through 1.5.7 and 1.6.x through 1.6.7 insufficiently filters Cascading Style Sheets (CSS) token sequences in rendered e-mail messages, allowing a remote attacker to obtain sensitive information.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
None
Availability
None

Exploit likelihood

66.7%Up 66.6 points since Aug 6, 2024
90%50%10%1%

What each source reports

CVE List Score used 7.5

mod_css_styles in Roundcube through 1.5.7 and 1.6.x through 1.6.7 insufficiently filters Cascading Style Sheets (CSS) token sequences in rendered e-mail messages, allowing a remote attacker to obtain sensitive information.

Record
CVE-2024-42010
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-200
Updated
2026-11-02
EUVDEUVD-2024-39392 7.5

mod_css_styles in Roundcube through 1.5.7 and 1.6.x through 1.6.7 insufficiently filters Cascading Style Sheets (CSS) token sequences in rendered e-mail messages, allowing a remote attacker to obtain sensitive information.

Record
EUVD-2024-39392
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-03
GitHub AdvisoriesGHSA-853r-xr2f-r2x6 7.5

mod_css_styles in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a insufficiently filters...

mod_css_styles in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a insufficiently filters Cascading Style Sheets (CSS) token sequences in rendered e-mail messages, allowing a remote attacker to obtain sensitive information.

Record
GHSA-853r-xr2f-r2x6
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-200
Updated
2026-11-02
NVD 7.5

mod_css_styles in Roundcube through 1.5.7 and 1.6.x through 1.6.7 insufficiently filters Cascading Style Sheets (CSS) token sequences in rendered e-mail messages, allowing a remote attacker to obtain sensitive information.

Record
CVE-2024-42010
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-200
Updated
2026-11-02
OSV 7.5

mod_css_styles in Roundcube through 1.5.7 and 1.6.x through 1.6.7 insufficiently filters Cascading Style Sheets (CSS) token sequences in rendered e-mail messages, allowing a remote attacker to obtain sensitive information.

Record
CVE-2024-42010
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVDEBIAN-CVE-2024-42010 7.5

mod_css_styles in Roundcube through 1.5.7 and 1.6.x through 1.6.7 insufficiently filters Cascading Style Sheets (CSS) token sequences in rendered e-mail messages, allowing a remote attacker to obtain sensitive information.

Record
DEBIAN-CVE-2024-42010
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
Show 4 moreShow less
OSVUBUNTU-CVE-2024-42010 7.5

mod_css_styles in Roundcube through 1.5.7 and 1.6.x through 1.6.7 insufficiently filters Cascading Style Sheets (CSS) token sequences in rendered e-mail messages, allowing a remote attacker to obtain sensitive information.

Record
UBUNTU-CVE-2024-42010
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVMGASA-2024-0279 No score

Updated roundcubemail packages fix security vulnerabilities

Fix XSS vulnerability in post-processing of sanitized HTML content [CVE-2024-42009] Fix XSS vulnerability in serving of attachments other than HTML or SVG [CVE-2024-42008] Fix information leak (access to remote content) via insufficient CSS filtering [CVE-2024-42010]

Record
MGASA-2024-0279
Updated
2026-11-02
OSVopenSUSE-SU-2024:0328-1 No score

Security update for roundcubemail

This update for roundcubemail fixes the following issues:

Update to 1.6.8 This is a security update to the stable version 1.6 of Roundcube Webmail. It provides fixes to recently reported security vulnerabilities:

  • Fix XSS vulnerability in post-processing of sanitized HTML content [CVE-2024-42009]
  • Fix XSS vulnerability in serving of attachments other than HTML or SVG [CVE-2024-42008]
  • Fix information leak (access to remote content) via insufficient CSS filtering [CVE-2024-42010]

CHANGELOG

  • Managesieve: Protect special scripts in managesieve_kolab_master mode
  • Fix newmail_notifier notification focus in Chrome (#9467)
  • Fix fatal error when parsing some TNEF attachments (#9462)
  • Fix double scrollbar when composing a mail with many plain text lines (#7760)
  • Fix decoding mail parts with multiple base64-encoded text blocks (#9290)
  • Fix bug where some messages could get malformed in an import from a MBOX file (#9510)
  • Fix invalid line break characters in multi-line text in Sieve scripts (#9543)
  • Fix bug where 'with attachment' filter could fail on some fts engines (#9514)
  • Fix bug where an unhandled exception was caused by an invalid image attachment (#9475)
  • Fix bug where a long subject title could not be displayed in some cases (#9416)
  • Fix infinite loop when parsing malformed Sieve script (#9562)
  • Fix bug where imap_conn_option's 'socket' was ignored (#9566)
  • Fix XSS vulnerability in post-processing of sanitized HTML content [CVE-2024-42009]
  • Fix XSS vulnerability in serving of attachments other than HTML or SVG [CVE-2024-42008]
  • Fix information leak (access to remote content) via insufficient CSS filtering [CVE-2024-42010]
Record
openSUSE-SU-2024:0328-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:14243-1 No score

roundcubemail-1.6.8-1.1 on GA media

These are all security issues fixed in the roundcubemail-1.6.8-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:14243-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
roundcube
Debian:12
 before 1.6.5+dfsg-1+deb12u3, plus listed versions
1.6.1+dfsg-11.6.2+dfsg-11.6.3+dfsg-11.6.3+dfsg-1~deb12u11.6.3+dfsg-2
Show 5 moreShow less
1.6.4+dfsg-11.6.4+dfsg-1~deb12u11.6.5+dfsg-11.6.5+dfsg-1+deb12u21.6.5+dfsg-1~deb12u1
1.6.5+dfsg-1+deb12u3
roundcube
Debian:13
 before 1.6.8+dfsg-1
1.6.8+dfsg-1
roundcube
Debian:14
 before 1.6.8+dfsg-1
1.6.8+dfsg-1
roundcube
Debian:12
From an advisory covering 3 CVEs
 before 1.6.5+dfsg-1+deb12u3, plus listed versions
1.6.1+dfsg-11.6.2+dfsg-11.6.3+dfsg-11.6.3+dfsg-1~deb12u11.6.3+dfsg-2
Show 5 moreShow less
1.6.4+dfsg-11.6.4+dfsg-1~deb12u11.6.5+dfsg-11.6.5+dfsg-1+deb12u21.6.5+dfsg-1~deb12u1
1.6.5+dfsg-1+deb12u3
roundcube
Debian:11
From an advisory covering 3 CVEs
 before 1.4.15+dfsg.1-1+deb11u4, plus listed versions
1.4.11+dfsg.1-41.4.12+dfsg.1-1~bpo10+11.4.12+dfsg.1-1~deb11u11.4.13+dfsg.1-1~deb11u11.4.13+dfsg.1-1~deb11u1~bpo10+1
Show 7 moreShow less
1.4.14+dfsg.1-1~deb11u11.4.14+dfsg.1-1~deb11u1~bpo10+11.4.15+dfsg.1-1+deb11u31.4.15+dfsg.1-1~deb11u11.4.15+dfsg.1-1~deb11u1~bpo10+11.4.15+dfsg.1-1~deb11u21.4.15+dfsg.1-1~deb11u2~bpo10+1
1.4.15+dfsg.1-1+deb11u4
roundcubemail
Mageia:9
From an advisory covering 3 CVEs
 before 1.6.8-1.mga9
1.6.8-1.mga9
roundcube
Ubuntu:Pro:16.04:LTS
 before 1.2~beta+dfsg.1-0ubuntu1+esm8, plus listed versions
1.1.1+dfsg.1-21.1.2+dfsg.1-51.1.3+dfsg.1-11.1.4+dfsg.1-11.2~beta+dfsg.1-0ubuntu1
Show 7 moreShow less
1.2~beta+dfsg.1-0ubuntu1+esm11.2~beta+dfsg.1-0ubuntu1+esm21.2~beta+dfsg.1-0ubuntu1+esm31.2~beta+dfsg.1-0ubuntu1+esm41.2~beta+dfsg.1-0ubuntu1+esm51.2~beta+dfsg.1-0ubuntu1+esm61.2~beta+dfsg.1-0ubuntu1+esm7
1.2~beta+dfsg.1-0ubuntu1+esm8
roundcube
Ubuntu:Pro:18.04:LTS
 before 1.3.6+dfsg.1-1ubuntu0.1~esm8, plus listed versions
1.3.0+dfsg.1-11.3.1+dfsg.1-11.3.3+dfsg.1-11.3.3+dfsg.1-21.3.6+dfsg.1-1
Show 7 moreShow less
1.3.6+dfsg.1-1ubuntu0.1~esm11.3.6+dfsg.1-1ubuntu0.1~esm21.3.6+dfsg.1-1ubuntu0.1~esm31.3.6+dfsg.1-1ubuntu0.1~esm41.3.6+dfsg.1-1ubuntu0.1~esm51.3.6+dfsg.1-1ubuntu0.1~esm61.3.6+dfsg.1-1ubuntu0.1~esm7
1.3.6+dfsg.1-1ubuntu0.1~esm8
roundcube
Ubuntu:Pro:20.04:LTS
 before 1.4.3+dfsg.1-1ubuntu0.1~esm8, plus listed versions
1.3.8+dfsg.1-21.3.10+dfsg.1-11.4.1+dfsg.1-21.4.2+dfsg.1-11.4.2+dfsg.1-2
Show 8 moreShow less
1.4.3+dfsg.1-11.4.3+dfsg.1-1ubuntu0.1~esm11.4.3+dfsg.1-1ubuntu0.1~esm21.4.3+dfsg.1-1ubuntu0.1~esm31.4.3+dfsg.1-1ubuntu0.1~esm41.4.3+dfsg.1-1ubuntu0.1~esm51.4.3+dfsg.1-1ubuntu0.1~esm61.4.3+dfsg.1-1ubuntu0.1~esm7
1.4.3+dfsg.1-1ubuntu0.1~esm8
roundcube
Ubuntu:Pro:22.04:LTS
 before 1.5.0+dfsg.1-2ubuntu0.1~esm6, plus listed versions
1.4.11+dfsg.1-41.5.0+dfsg.1-21.5.0+dfsg.1-2ubuntu0.1~esm11.5.0+dfsg.1-2ubuntu0.1~esm21.5.0+dfsg.1-2ubuntu0.1~esm31.5.0+dfsg.1-2ubuntu0.1~esm41.5.0+dfsg.1-2ubuntu0.1~esm5
1.5.0+dfsg.1-2ubuntu0.1~esm6
Show 6 moreShow less
Affected packages
PackageAffectedFixed
roundcube
Ubuntu:Pro:24.04:LTS
 before 1.6.6+dfsg-2ubuntu0.1+esm3, plus listed versions
1.6.2+dfsg-11.6.4+dfsg-11.6.5+dfsg-11.6.6+dfsg-11.6.6+dfsg-21.6.6+dfsg-2ubuntu0.11.6.6+dfsg-2ubuntu0.1+esm11.6.6+dfsg-2ubuntu0.1+esm2
1.6.6+dfsg-2ubuntu0.1+esm3
roundcubemail
SUSE:Package Hub 15 SP5
From an advisory covering 3 CVEs
 before 1.6.8-bp156.2.3.1
1.6.8-bp156.2.3.1
roundcubemail
SUSE:Package Hub 15 SP6
From an advisory covering 3 CVEs
 before 1.6.8-bp156.2.3.1
1.6.8-bp156.2.3.1
roundcubemail
openSUSE:Leap 15.5
From an advisory covering 3 CVEs
 before 1.6.8-bp156.2.3.1
1.6.8-bp156.2.3.1
roundcubemail
openSUSE:Leap 15.6
From an advisory covering 3 CVEs
 before 1.6.8-bp156.2.3.1
1.6.8-bp156.2.3.1
roundcubemail
openSUSE:Tumbleweed
From an advisory covering 3 CVEs
 before 1.6.8-1.1
1.6.8-1.1

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-42010 is a high vulnerability (CVSS 7.5) in Roundcube, published August 5, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 66.7%, the 99th percentile. Fixed in roundcube 1.6.5+dfsg-1+deb12u3.

References

Show 15 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open