{"id":"CVE-2024-42010","aliases":["DEBIAN-CVE-2024-42010","DSA-5743-1","DSA-5743-2","EUVD-2024-39392","GHSA-853r-xr2f-r2x6","MGASA-2024-0279","UBUNTU-CVE-2024-42010","openSUSE-SU-2024:0328-1","openSUSE-SU-2024:14243-1"],"status":"published","title":"mod_css_styles in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a insufficiently filters...","description":"mod_css_styles in Roundcube through 1.5.7 and 1.6.x through 1.6.7 insufficiently filters Cascading Style Sheets (CSS) token sequences in rendered e-mail messages, allowing a remote attacker to obtain sensitive information.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-09","score":0.66661,"percentile":0.99295,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-200"],"published":"2024-08-05T00:00:00Z","modified":"2026-11-02T12:02:58Z","fixes":[{"ecosystem":"Debian:12","package":"roundcube","fixed_in":["1.6.5+dfsg-1+deb12u3"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"roundcube","fixed_in":["1.6.8+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"roundcube","fixed_in":["1.6.8+dfsg-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"roundcube","fixed_in":["1.2~beta+dfsg.1-0ubuntu1+esm8"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"roundcube","fixed_in":["1.3.6+dfsg.1-1ubuntu0.1~esm8"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"roundcube","fixed_in":["1.4.3+dfsg.1-1ubuntu0.1~esm8"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:22.04:LTS","package":"roundcube","fixed_in":["1.5.0+dfsg.1-2ubuntu0.1~esm6"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:24.04:LTS","package":"roundcube","fixed_in":["1.6.6+dfsg-2ubuntu0.1+esm3"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"roundcube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.5+dfsg-1+deb12u3"}]}],"versions":["1.6.1+dfsg-1","1.6.2+dfsg-1","1.6.3+dfsg-1","1.6.3+dfsg-1~deb12u1","1.6.3+dfsg-2","1.6.4+dfsg-1","1.6.4+dfsg-1~deb12u1","1.6.5+dfsg-1","1.6.5+dfsg-1+deb12u2","1.6.5+dfsg-1~deb12u1"]},{"source":"osv","ecosystem":"Debian:13","package":"roundcube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.8+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"roundcube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.8+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"roundcube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.5+dfsg-1+deb12u3"}]}],"versions":["1.6.1+dfsg-1","1.6.2+dfsg-1","1.6.3+dfsg-1","1.6.3+dfsg-1~deb12u1","1.6.3+dfsg-2","1.6.4+dfsg-1","1.6.4+dfsg-1~deb12u1","1.6.5+dfsg-1","1.6.5+dfsg-1+deb12u2","1.6.5+dfsg-1~deb12u1"],"bundled":3},{"source":"osv","ecosystem":"Debian:11","package":"roundcube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.15+dfsg.1-1+deb11u4"}]}],"versions":["1.4.11+dfsg.1-4","1.4.12+dfsg.1-1~bpo10+1","1.4.12+dfsg.1-1~deb11u1","1.4.13+dfsg.1-1~deb11u1","1.4.13+dfsg.1-1~deb11u1~bpo10+1","1.4.14+dfsg.1-1~deb11u1","1.4.14+dfsg.1-1~deb11u1~bpo10+1","1.4.15+dfsg.1-1+deb11u3","1.4.15+dfsg.1-1~deb11u1","1.4.15+dfsg.1-1~deb11u1~bpo10+1","1.4.15+dfsg.1-1~deb11u2","1.4.15+dfsg.1-1~deb11u2~bpo10+1"],"bundled":3},{"source":"osv","ecosystem":"Mageia:9","package":"roundcubemail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.8-1.mga9"}]}],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"roundcube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2~beta+dfsg.1-0ubuntu1+esm8"}]}],"versions":["1.1.1+dfsg.1-2","1.1.2+dfsg.1-5","1.1.3+dfsg.1-1","1.1.4+dfsg.1-1","1.2~beta+dfsg.1-0ubuntu1","1.2~beta+dfsg.1-0ubuntu1+esm1","1.2~beta+dfsg.1-0ubuntu1+esm2","1.2~beta+dfsg.1-0ubuntu1+esm3","1.2~beta+dfsg.1-0ubuntu1+esm4","1.2~beta+dfsg.1-0ubuntu1+esm5","1.2~beta+dfsg.1-0ubuntu1+esm6","1.2~beta+dfsg.1-0ubuntu1+esm7"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"roundcube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.6+dfsg.1-1ubuntu0.1~esm8"}]}],"versions":["1.3.0+dfsg.1-1","1.3.1+dfsg.1-1","1.3.3+dfsg.1-1","1.3.3+dfsg.1-2","1.3.6+dfsg.1-1","1.3.6+dfsg.1-1ubuntu0.1~esm1","1.3.6+dfsg.1-1ubuntu0.1~esm2","1.3.6+dfsg.1-1ubuntu0.1~esm3","1.3.6+dfsg.1-1ubuntu0.1~esm4","1.3.6+dfsg.1-1ubuntu0.1~esm5","1.3.6+dfsg.1-1ubuntu0.1~esm6","1.3.6+dfsg.1-1ubuntu0.1~esm7"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"roundcube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.3+dfsg.1-1ubuntu0.1~esm8"}]}],"versions":["1.3.8+dfsg.1-2","1.3.10+dfsg.1-1","1.4.1+dfsg.1-2","1.4.2+dfsg.1-1","1.4.2+dfsg.1-2","1.4.3+dfsg.1-1","1.4.3+dfsg.1-1ubuntu0.1~esm1","1.4.3+dfsg.1-1ubuntu0.1~esm2","1.4.3+dfsg.1-1ubuntu0.1~esm3","1.4.3+dfsg.1-1ubuntu0.1~esm4","1.4.3+dfsg.1-1ubuntu0.1~esm5","1.4.3+dfsg.1-1ubuntu0.1~esm6","1.4.3+dfsg.1-1ubuntu0.1~esm7"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"roundcube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.0+dfsg.1-2ubuntu0.1~esm6"}]}],"versions":["1.4.11+dfsg.1-4","1.5.0+dfsg.1-2","1.5.0+dfsg.1-2ubuntu0.1~esm1","1.5.0+dfsg.1-2ubuntu0.1~esm2","1.5.0+dfsg.1-2ubuntu0.1~esm3","1.5.0+dfsg.1-2ubuntu0.1~esm4","1.5.0+dfsg.1-2ubuntu0.1~esm5"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"roundcube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.6+dfsg-2ubuntu0.1+esm3"}]}],"versions":["1.6.2+dfsg-1","1.6.4+dfsg-1","1.6.5+dfsg-1","1.6.6+dfsg-1","1.6.6+dfsg-2","1.6.6+dfsg-2ubuntu0.1","1.6.6+dfsg-2ubuntu0.1+esm1","1.6.6+dfsg-2ubuntu0.1+esm2"]},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP5","package":"roundcubemail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.8-bp156.2.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP6","package":"roundcubemail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.8-bp156.2.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"roundcubemail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.8-bp156.2.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"roundcubemail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.8-bp156.2.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"roundcubemail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.8-1.1"}]}],"bundled":3}],"products":[{"vendor":"roundcube","product":"roundcube"}],"references":[{"url":"https://github.com/roundcube/roundcubemail/releases","tags":["package","report"]},{"url":"https://sonarsource.com/blog/government-emails-at-risk-critical-cross-site-scripting-vulnerability-in-roundcube-webmail/","tags":["article","report"]},{"url":"https://github.com/roundcube/roundcubemail/releases/tag/1.5.8","tags":["web","report"]},{"url":"https://github.com/roundcube/roundcubemail/releases/tag/1.6.8","tags":["web","report"]},{"url":"https://roundcube.net/news/2024/08/04/security-updates-1.6.8-and-1.5.8","tags":["web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-42010","tags":["advisory"]},{"url":"https://sonarsource.com/blog/government-emails-at-risk-critical-cross-site-scripting-vulnerability-in-roundcube-webmail"},{"url":"https://github.com/advisories/GHSA-853r-xr2f-r2x6"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/42xxx/CVE-2024-42010.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-42010","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2024-0279.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=33460","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-42010","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-42010","tags":["report"]},{"url":"https://github.com/roundcube/roundcubemail/commit/602d0f566eb39b6dcb739ad78323ec434a3b92ce","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8223-1","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/Q5GOCYS6W7WGAIH6NILISNVXQC4O7Z53/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1228900","tags":["report"]},{"url":"https://bugzilla.suse.com/1228901","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-42008","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-42009","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-42010","tags":["web"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2024-42010","description":"mod_css_styles in Roundcube through 1.5.7 and 1.6.x through 1.6.7 insufficiently filters Cascading Style Sheets (CSS) token sequences in rendered e-mail messages, allowing a remote attacker to obtain sensitive information.","status":"published","published":"2024-08-05T00:00:00Z","modified":"2024-08-12T13:42:04.196Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"adp"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:34:03.00063Z"}],"euvd":[{"id":"EUVD-2024-39392","description":"mod_css_styles in Roundcube through 1.5.7 and 1.6.x through 1.6.7 insufficiently filters Cascading Style Sheets (CSS) token sequences in rendered e-mail messages, allowing a remote attacker to obtain sensitive information.","status":"published","published":"2024-08-05T00:00:00Z","modified":"2024-08-12T13:42:04Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-03T00:56:20.205836Z"}],"ghsa":[{"id":"GHSA-853r-xr2f-r2x6","title":"mod_css_styles in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a insufficiently filters...","description":"mod_css_styles in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a insufficiently filters Cascading Style Sheets (CSS) token sequences in rendered e-mail messages, allowing a remote attacker to obtain sensitive information.","status":"published","published":"2024-08-05T21:31:19Z","modified":"2024-08-06T15:31:53Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:57:52.387174Z"}],"nvd":[{"id":"CVE-2024-42010","description":"mod_css_styles in Roundcube through 1.5.7 and 1.6.x through 1.6.7 insufficiently filters Cascading Style Sheets (CSS) token sequences in rendered e-mail messages, allowing a remote attacker to obtain sensitive information.","status":"published","published":"2024-08-05T19:15:38.273Z","modified":"2026-06-17T07:48:38.097Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:10:17.832118Z"}],"osv":[{"id":"CVE-2024-42010","description":"mod_css_styles in Roundcube through 1.5.7 and 1.6.x through 1.6.7 insufficiently filters Cascading Style Sheets (CSS) token sequences in rendered e-mail messages, allowing a remote attacker to obtain sensitive information.","status":"published","published":"2024-08-05T00:00:00Z","modified":"2026-10-28T02:30:59.767776005Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:44:41.963899Z"},{"id":"DEBIAN-CVE-2024-42010","description":"mod_css_styles in Roundcube through 1.5.7 and 1.6.x through 1.6.7 insufficiently filters Cascading Style Sheets (CSS) token sequences in rendered e-mail messages, allowing a remote attacker to obtain sensitive information.","status":"published","published":"2024-08-05T19:15:38.273Z","modified":"2026-11-02T12:02:58.877580097Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:43.156294Z"},{"id":"UBUNTU-CVE-2024-42010","description":"mod_css_styles in Roundcube through 1.5.7 and 1.6.x through 1.6.7 insufficiently filters Cascading Style Sheets (CSS) token sequences in rendered e-mail messages, allowing a remote attacker to obtain sensitive information.","status":"published","published":"2024-08-05T19:15:00Z","modified":"2026-04-30T09:42:31.594516Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T16:54:58.679387Z"},{"id":"DSA-5743-1","title":"roundcube - security update","status":"published","published":"2024-08-08T00:00:00Z","modified":"2026-03-09T02:09:39.888358Z","updated_at":"2026-11-02T15:46:17.892347Z"},{"id":"DSA-5743-2","title":"roundcube - security update","status":"published","published":"2024-08-13T00:00:00Z","modified":"2026-03-09T02:11:29.044594Z","updated_at":"2026-11-02T15:46:17.892347Z"},{"id":"MGASA-2024-0279","title":"Updated roundcubemail packages fix security vulnerabilities","description":"Fix XSS vulnerability in post-processing of sanitized HTML content\n[CVE-2024-42009]\nFix XSS vulnerability in serving of attachments other than HTML or SVG\n[CVE-2024-42008]\nFix information leak (access to remote content) via insufficient CSS\nfiltering [CVE-2024-42010]\n","status":"published","published":"2024-08-15T17:48:28Z","modified":"2026-04-16T04:43:50.841274176Z","updated_at":"2026-11-02T15:49:42.684501Z"},{"id":"openSUSE-SU-2024:0328-1","title":"Security update for roundcubemail","description":"This update for roundcubemail fixes the following issues:\n\nUpdate to 1.6.8\nThis is a security update to the stable version 1.6 of Roundcube Webmail.\nIt provides fixes to recently reported security vulnerabilities:\n\n  * Fix XSS vulnerability in post-processing of sanitized HTML content [CVE-2024-42009]\n  * Fix XSS vulnerability in serving of attachments other than HTML or SVG [CVE-2024-42008]\n  * Fix information leak (access to remote content) via insufficient CSS filtering [CVE-2024-42010]\n\n  CHANGELOG\n\n  * Managesieve: Protect special scripts in managesieve_kolab_master mode\n  * Fix newmail_notifier notification focus in Chrome (#9467)\n  * Fix fatal error when parsing some TNEF attachments (#9462)\n  * Fix double scrollbar when composing a mail with many plain text lines (#7760)\n  * Fix decoding mail parts with multiple base64-encoded text blocks (#9290)\n  * Fix bug where some messages could get malformed in an import from a MBOX file (#9510)\n  * Fix invalid line break characters in multi-line text in Sieve scripts (#9543)\n  * Fix bug where 'with attachment' filter could fail on some fts engines (#9514)\n  * Fix bug where an unhandled exception was caused by an invalid image attachment (#9475)\n  * Fix bug where a long subject title could not be displayed in some cases (#9416)\n  * Fix infinite loop when parsing malformed Sieve script (#9562)\n  * Fix bug where imap_conn_option's 'socket' was ignored (#9566)\n  * Fix XSS vulnerability in post-processing of sanitized HTML content [CVE-2024-42009]\n  * Fix XSS vulnerability in serving of attachments other than HTML or SVG [CVE-2024-42008]\n  * Fix information leak (access to remote content) via insufficient CSS filtering [CVE-2024-42010]\n","status":"published","published":"2024-10-09T08:01:27Z","modified":"2026-02-04T03:46:01.312116Z","updated_at":"2026-11-02T16:58:33.135986Z"},{"id":"openSUSE-SU-2024:14243-1","title":"roundcubemail-1.6.8-1.1 on GA media","description":"These are all security issues fixed in the roundcubemail-1.6.8-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-08-07T00:00:00Z","modified":"2026-02-04T02:22:21.707193Z","updated_at":"2026-11-02T16:58:36.662953Z"}]}}