{"id":"CVE-2023-47272","aliases":["BIT-roundcube-2023-47272","DEBIAN-CVE-2023-47272","DLA-3683-1","DSA-5572-1","EUVD-2023-51402","GHSA-q2wj-pp48-fpgj","MGASA-2023-0332","UBUNTU-CVE-2023-47272","USN-6848-1","openSUSE-SU-2024:0257-1","openSUSE-SU-2024:13401-1"],"status":"published","title":"Roundcube 1.5.x before 1.5.6 and 1.6.x before 1.6.5 allows XSS via a Content-Type or Content...","description":"Roundcube 1.5.x before 1.5.6 and 1.6.x before 1.6.5 allows XSS via a Content-Type or Content-Disposition header (used for attachment preview or download).","severity":{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AC:L/AV:N/A:N/C:L/I:L/PR:N/S:C/UI:R","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00756,"percentile":0.55662,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2023-11-05T00:00:00Z","modified":"2026-10-28T02:30:38Z","fixes":[{"ecosystem":"Bitnami","package":"roundcube","fixed_in":["1.5.6","1.6.5"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"roundcube","fixed_in":["1.6.5+dfsg-1~deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"roundcube","fixed_in":["1.6.5+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"roundcube","fixed_in":["1.6.5+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:10","package":"roundcube","fixed_in":["1.3.17+dfsg.1-1~deb10u5"],"sources":["osv"]},{"ecosystem":"Debian:11","package":"roundcube","fixed_in":["1.4.15+dfsg.1-1~deb11u2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"roundcube","fixed_in":["1.4.3+dfsg.1-1ubuntu0.1~esm4"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:22.04:LTS","package":"roundcube","fixed_in":["1.5.0+dfsg.1-2ubuntu0.1~esm3"],"sources":["osv"]},{"ecosystem":"SUSE:Package Hub 15 SP5","package":"roundcubemail","fixed_in":["1.6.7-bp155.2.9.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.5","package":"roundcubemail","fixed_in":["1.6.7-bp155.2.9.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"roundcubemail","fixed_in":["1.6.5-1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Bitnami","package":"roundcube","ranges":[{"type":"SEMVER","events":[{"introduced":"1.5.0"},{"fixed":"1.5.6"},{"introduced":"1.6.0"},{"fixed":"1.6.5"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"roundcube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.5+dfsg-1~deb12u1"}]}],"versions":["1.6.1+dfsg-1","1.6.2+dfsg-1","1.6.3+dfsg-1","1.6.3+dfsg-1~deb12u1","1.6.3+dfsg-2","1.6.4+dfsg-1","1.6.4+dfsg-1~deb12u1"]},{"source":"osv","ecosystem":"Debian:13","package":"roundcube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.5+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"roundcube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.5+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:10","package":"roundcube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.17+dfsg.1-1~deb10u5"}]}],"versions":["1.3.10+dfsg.1-1","1.3.10+dfsg.1-1~deb10u1","1.3.11+dfsg.1-1~deb10u1","1.3.13+dfsg.1-1~deb10u1","1.3.14+dfsg.1-1~deb10u1","1.3.15+dfsg.1-1~deb10u1","1.3.16+dfsg.1-1~deb10u1","1.3.17+dfsg.1-1~deb10u1","1.3.17+dfsg.1-1~deb10u2","1.3.17+dfsg.1-1~deb10u3","1.3.17+dfsg.1-1~deb10u4","1.3.8+dfsg.1-2"]},{"source":"osv","ecosystem":"Debian:11","package":"roundcube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.15+dfsg.1-1~deb11u2"}]}],"versions":["1.4.11+dfsg.1-4","1.4.12+dfsg.1-1~bpo10+1","1.4.12+dfsg.1-1~deb11u1","1.4.13+dfsg.1-1~deb11u1","1.4.13+dfsg.1-1~deb11u1~bpo10+1","1.4.14+dfsg.1-1~deb11u1","1.4.14+dfsg.1-1~deb11u1~bpo10+1","1.4.15+dfsg.1-1~deb11u1","1.4.15+dfsg.1-1~deb11u1~bpo10+1","1.4.15+dfsg.1-1~deb11u2~bpo10+1"]},{"source":"osv","ecosystem":"Debian:12","package":"roundcube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.5+dfsg-1~deb12u1"}]}],"versions":["1.6.1+dfsg-1","1.6.2+dfsg-1","1.6.3+dfsg-1","1.6.3+dfsg-1~deb12u1","1.6.3+dfsg-2","1.6.4+dfsg-1","1.6.4+dfsg-1~deb12u1"]},{"source":"osv","ecosystem":"Mageia:9","package":"roundcubemail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.5-1.mga9"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"roundcube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.3+dfsg.1-1ubuntu0.1~esm4"}]}],"versions":["1.3.8+dfsg.1-2","1.3.10+dfsg.1-1","1.4.1+dfsg.1-2","1.4.2+dfsg.1-1","1.4.2+dfsg.1-2","1.4.3+dfsg.1-1","1.4.3+dfsg.1-1ubuntu0.1~esm1","1.4.3+dfsg.1-1ubuntu0.1~esm2","1.4.3+dfsg.1-1ubuntu0.1~esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"roundcube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.0+dfsg.1-2ubuntu0.1~esm3"}]}],"versions":["1.4.11+dfsg.1-4","1.5.0+dfsg.1-2","1.5.0+dfsg.1-2ubuntu0.1~esm1","1.5.0+dfsg.1-2ubuntu0.1~esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"roundcube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2~beta+dfsg.1-0ubuntu1+esm4"}]}],"versions":["1.1.1+dfsg.1-2","1.1.2+dfsg.1-5","1.1.3+dfsg.1-1","1.1.4+dfsg.1-1","1.2~beta+dfsg.1-0ubuntu1","1.2~beta+dfsg.1-0ubuntu1+esm1","1.2~beta+dfsg.1-0ubuntu1+esm2","1.2~beta+dfsg.1-0ubuntu1+esm3"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"roundcube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.6+dfsg.1-1ubuntu0.1~esm4"}]}],"versions":["1.3.0+dfsg.1-1","1.3.1+dfsg.1-1","1.3.3+dfsg.1-1","1.3.3+dfsg.1-2","1.3.6+dfsg.1-1","1.3.6+dfsg.1-1ubuntu0.1~esm1","1.3.6+dfsg.1-1ubuntu0.1~esm2","1.3.6+dfsg.1-1ubuntu0.1~esm3"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"roundcube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.3+dfsg.1-1ubuntu0.1~esm4"}]}],"versions":["1.3.8+dfsg.1-2","1.3.10+dfsg.1-1","1.4.1+dfsg.1-2","1.4.2+dfsg.1-1","1.4.2+dfsg.1-2","1.4.3+dfsg.1-1","1.4.3+dfsg.1-1ubuntu0.1~esm1","1.4.3+dfsg.1-1ubuntu0.1~esm2","1.4.3+dfsg.1-1ubuntu0.1~esm3"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"roundcube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.0+dfsg.1-2ubuntu0.1~esm3"}]}],"versions":["1.4.11+dfsg.1-4","1.5.0+dfsg.1-2","1.5.0+dfsg.1-2ubuntu0.1~esm1","1.5.0+dfsg.1-2ubuntu0.1~esm2"],"bundled":4},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP5","package":"roundcubemail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.7-bp155.2.9.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"roundcubemail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.7-bp155.2.9.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"roundcubemail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.5-1.1"}]}]}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"fedoraproject","product":"fedora"},{"vendor":"roundcube","product":"webmail"}],"references":[{"url":"https://github.com/roundcube/roundcubemail/releases/tag/1.5.6","tags":["x_transferred","Release Notes","web","report"]},{"url":"https://github.com/roundcube/roundcubemail/releases/tag/1.6.5","tags":["x_transferred","Release Notes","web","report"]},{"url":"https://github.com/roundcube/roundcubemail/commit/5ec496885e18ec6af956e8c0d627856c2257ba2d","tags":["x_transferred","Patch","web","fix","report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z4F4DUA3Q46ZVB2RD7BFP4XMNS4RYFFQ/","tags":["vendor-advisory","x_transferred","Mailing List","web","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YFRGBPET73URF6364CI547ZVWQESJLGK/","tags":["vendor-advisory","x_transferred","Mailing List","web","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GILSR762MJB3BNJOVOCMW2JXEPV46IIQ/","tags":["vendor-advisory","x_transferred","Mailing List","web","advisory"]},{"url":"https://www.debian.org/security/2023/dsa-5572","tags":["vendor-advisory","x_transferred","Third Party Advisory","web","advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2023/12/msg00005.html","tags":["mailing-list","x_transferred","Third Party Advisory","web","article"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-47272","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-q2wj-pp48-fpgj"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/47xxx/CVE-2023-47272.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-47272","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2023-0332.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=32493","tags":["report"]},{"url":"https://github.com/roundcube/roundcubemail/releases/tag/1.6.4","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2023-47272","tags":["report"]},{"url":"https://github.com/roundcube/roundcubemail/commit/81ac3c342a4f288deb275590895b52ec3785cf8a","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-47272","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-6848-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2023-5631","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-37383","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-37384","tags":["report"]},{"url":"https://launchpad.net/bugs/2043396","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/JQ3GTO6YI3BLAIR7PQZYZ5LRFR7OKTWN/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1216895","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-47272","tags":["web"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2023-47272","description":"Roundcube 1.5.x before 1.5.6 and 1.6.x before 1.6.5 allows XSS via a Content-Type or Content-Disposition header (used for attachment preview or download).","status":"published","published":"2023-11-05T00:00:00Z","modified":"2024-08-02T21:09:37.368Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AC:L/AV:N/A:N/C:L/I:L/PR:N/S:C/UI:R","level":"medium","assessor":"cna"}],"updated_at":"2026-11-02T14:35:13.912858Z"}],"euvd":[{"id":"EUVD-2023-51402","description":"Roundcube 1.5.x before 1.5.6 and 1.6.x before 1.6.5 allows XSS via a Content-Type or Content-Disposition header (used for attachment preview or download).","status":"published","published":"2023-11-05T00:00:00Z","modified":"2024-08-02T21:09:37Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AC:L/AV:N/A:N/C:L/I:L/PR:N/S:C/UI:R","level":"medium"}],"updated_at":"2026-11-03T03:49:57.829961Z"}],"ghsa":[{"id":"GHSA-q2wj-pp48-fpgj","title":"Roundcube 1.5.x before 1.5.6 and 1.6.x before 1.6.5 allows XSS via a Content-Type or Content...","description":"Roundcube 1.5.x before 1.5.6 and 1.6.x before 1.6.5 allows XSS via a Content-Type or Content-Disposition header (used for attachment preview or download).","status":"published","published":"2023-11-06T00:30:16Z","modified":"2023-12-05T03:30:21Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:55:08.580325Z"}],"nvd":[{"id":"CVE-2023-47272","description":"Roundcube 1.5.x before 1.5.6 and 1.6.x before 1.6.5 allows XSS via a Content-Type or Content-Disposition header (used for attachment preview or download).","status":"published","published":"2023-11-06T00:15:09.38Z","modified":"2026-06-17T06:32:32.417Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:08:43.669554Z"}],"osv":[{"id":"CVE-2023-47272","description":"Roundcube 1.5.x before 1.5.6 and 1.6.x before 1.6.5 allows XSS via a Content-Type or Content-Disposition header (used for attachment preview or download).","status":"published","published":"2023-11-05T00:00:00Z","modified":"2026-10-28T02:30:38.072320371Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AC:L/AV:N/A:N/C:L/I:L/PR:N/S:C/UI:R","level":"medium"}],"updated_at":"2026-11-02T15:44:34.287121Z"},{"id":"DEBIAN-CVE-2023-47272","description":"Roundcube 1.5.x before 1.5.6 and 1.6.x before 1.6.5 allows XSS via a Content-Type or Content-Disposition header (used for attachment preview or download).","status":"published","published":"2023-11-06T00:15:09.38Z","modified":"2026-10-26T18:02:42.923405415Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:40.275853Z"},{"id":"UBUNTU-CVE-2023-47272","description":"Roundcube 1.5.x before 1.5.6 and 1.6.x before 1.6.5 allows XSS via a Content-Type or Content-Disposition header (used for attachment preview or download).","status":"published","published":"2023-11-06T00:15:00Z","modified":"2026-02-04T04:11:42.035714Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"},{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T16:54:23.935133Z"},{"id":"BIT-roundcube-2023-47272","description":"Roundcube 1.5.x before 1.5.6 and 1.6.x before 1.6.5 allows XSS via a Content-Type or Content-Disposition header (used for attachment preview or download).","status":"published","published":"2024-03-06T11:04:04.305Z","modified":"2024-03-06T11:25:28.861Z","updated_at":"2026-11-02T15:28:35.111822Z"},{"id":"DLA-3683-1","title":"roundcube - security update","status":"published","published":"2023-12-05T00:00:00Z","modified":"2026-03-09T01:23:03.025528Z","updated_at":"2026-11-02T15:46:12.203458Z"},{"id":"DSA-5572-1","title":"roundcube - security update","status":"published","published":"2023-12-04T00:00:00Z","modified":"2026-03-09T02:10:53.041917Z","updated_at":"2026-11-02T15:46:17.892347Z"},{"id":"MGASA-2023-0332","title":"Updated roundcubemail packages fix XSS security vulnerabilities","description":"Updated roundcubemail package fixes security vulnerabilities:\n\nFix cross-site scripting (XSS) vulnerability in setting Content-Type/\nContent-Disposition for attachment preview/download (CVE-2023-47272)\n\nFix cross-site scripting (XSS) vulnerability in handling of SVG in HTML\nmessages. (CVE-2023-5631)\n\nSome other errors have been fixed:\n- Fix PHP8 fatal error when parsing a malformed BODYSTRUCTURE\n- Fix duplicated Inbox folder on IMAP servers that do not use Inbox\n  folder with all capital letters\n- Fix PHP warnings\n- Fix UI issue when dealing with an invalid managesieve_default_headers\n  value\n- Fix bug where images attached to application/smil messages weren't\n  displayed\n- Fix PHP string replacement error in utils/error.php\n- Fix regression where smtp_user did not allow pre/post strings\n  before/after %u placeholder\n","status":"published","published":"2023-12-01T11:54:47Z","modified":"2026-04-16T04:42:18.383637496Z","updated_at":"2026-11-02T15:49:42.684501Z"},{"id":"openSUSE-SU-2024:0257-1","title":"Security update for roundcubemail","description":"This update for roundcubemail fixes the following issues:\n\nUpdate to 1.6.7\n\nThis is a security update to the stable version 1.6 of Roundcube Webmail.\nIt provides a fix to a recently reported XSS vulnerabilities:\n\n  * Fix cross-site scripting (XSS) vulnerability in handling SVG animate attributes.\n    Reported by Valentin T. and Lutz Wolf of CrowdStrike.\n  * Fix cross-site scripting (XSS) vulnerability in handling list columns from user preferences.\n    Reported by Huy Nguyễn Phạm Nhật.\n  * Fix command injection via crafted im_convert_path/im_identify_path on Windows.\n    Reported by Huy Nguyễn Phạm Nhật.\n\n  CHANGELOG\n\n  * Makefile: Use phpDocumentor v3.4 for the Framework docs (#9313)\n  * Fix bug where HTML entities in URLs were not decoded on HTML to plain text conversion (#9312)\n  * Fix bug in collapsing/expanding folders with some special characters in names (#9324)\n  * Fix PHP8 warnings (#9363, #9365, #9429)\n  * Fix missing field labels in CSV import, for some locales (#9393)\n  * Fix cross-site scripting (XSS) vulnerability in handling SVG animate attributes\n  * Fix cross-site scripting (XSS) vulnerability in handling list columns from user preferences\n  * Fix command injection via crafted im_convert_path/im_identify_path on Windows\n\nUpdate to 1.6.6:\n\n  * Fix regression in handling LDAP search_fields configuration parameter (#9210)\n  * Enigma: Fix finding of a private key when decrypting a message using GnuPG v2.3\n  * Fix page jump menu flickering on click (#9196)\n  * Update to TinyMCE 5.10.9 security release (#9228)\n  * Fix PHP8 warnings (#9235, #9238, #9242, #9306)\n  * Fix saving other encryption settings besides enigma's (#9240)\n  * Fix unneeded php command use in installto.sh and deluser.sh scripts (#9237)\n  * Fix TinyMCE localization installation (#9266)\n  * Fix bug where trailing non-ascii characters in email addresses \n    could have been removed in recipient input (#9257)\n  * Fix IMAP GETMETADATA command with options - RFC5464\n\nUpdate to 1.6.5 (boo#1216895):\n\n  * Fix cross-site scripting (XSS) vulnerability in setting \n    Content-Type/Content-Disposition for attachment \n    preview/download  CVE-2023-47272\n\n  Other changes:\n\n  * Fix PHP8 fatal error when parsing a malformed BODYSTRUCTURE (#9171)\n  * Fix duplicated Inbox folder on IMAP servers that do not use Inbox \n    folder with all capital letters (#9166)\n  * Fix PHP warnings (#9174)\n  * Fix UI issue when dealing with an invalid managesieve_default_headers \n    value (#9175)\n  * Fix bug where images attached to application/smil messages \n    weren't displayed (#8870)\n  * Fix PHP string replacement error in utils/error.php (#9185)\n  * Fix regression where smtp_user did not allow pre/post strings \n    before/after %u placeholder (#9162)\n","status":"published","published":"2024-08-21T11:35:59Z","modified":"2026-02-04T03:21:20.400959Z","updated_at":"2026-11-02T16:58:33.135986Z"},{"id":"openSUSE-SU-2024:13401-1","title":"roundcubemail-1.6.5-1.1 on GA media","description":"These are all security issues fixed in the roundcubemail-1.6.5-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:42:33.568993Z","updated_at":"2026-11-02T16:58:36.327643Z"},{"id":"USN-6848-1","title":"roundcube vulnerabilities","description":"Matthieu Faou and Denys Klymenko discovered that Roundcube incorrectly\nhandled certain SVG images. A remote attacker could possibly use this\nissue to load arbitrary JavaScript code. This issue only affected Ubuntu\n18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS and Ubuntu 23.10.\n(CVE-2023-5631)\n\nRene Rehme discovered that Roundcube incorrectly handled certain headers.\nA remote attacker could possibly use this issue to load arbitrary\nJavaScript code. This issue only affected Ubuntu 20.04 LTS,\nUbuntu 22.04 LTS and Ubuntu 23.10. (CVE-2023-47272)\n\nValentin T. and Lutz Wolf discovered that Roundcube incorrectly handled\ncertain SVG images. A remote attacker could possibly use this issue to\nload arbitrary JavaScript code. This issue only affected Ubuntu 18.04 LTS,\nUbuntu 20.04 LTS, Ubuntu 22.04 LTS and Ubuntu 23.10. (CVE-2024-37383)\n\nHuy Nguyễn Phạm Nhật discovered that Roundcube incorrectly handled\ncertain fields in user preferences. A remote attacker could possibly use\nthis issue to load arbitrary JavaScript code. (CVE-2024-37384)\n","status":"published","published":"2024-06-25T18:16:54Z","modified":"2026-06-25T13:32:28.795533862Z","updated_at":"2026-11-02T16:58:17.914523Z"}]}}