roundcube 0.9.3 two XSS flaws

2013-08-25 / 2013-10-21
Credit: Vincent Danen
Risk: Low
Local: No
Remote: Yes
CVE: CVE-2013-5645 | CVE-2013-5646
CWE: CWE-79

Two XSS flaws were fixed in roundcube 0.9.3 [1]: * Fix XSS vulnerability when saving HTML signatures [2],[3] * Fix XSS vulnerability when editing a message "as new" or draft [2],[4] [1] http://trac.roundcube.net/wiki/Changelog#RELEASE0.9.3 [2] http://trac.roundcube.net/ticket/1489251 [3] http://trac.roundcube.net/changeset/ce5a6496fd6039962ba7424d153278e41ae8761b/github [4] http://trac.roundcube.net/changeset/93b0a30c1c8aa29d862b587b31e52bcc344b8d16/github Other references: http://bugs.gentoo.org/show_bug.cgi?id=482206 https://bugzilla.redhat.com/show_bug.cgi?id=1000510 Thanks.

References:

http://trac.roundcube.net/wiki/Changelog#RELEASE0.9.3
http://trac.roundcube.net/ticket/1489251
http://trac.roundcube.net/changeset/ce5a6496fd6039962ba7424d153278e41ae8761b/github
http://trac.roundcube.net/changeset/93b0a30c1c8aa29d862b587b31e52bcc344b8d16/github
http://bugs.gentoo.org/show_bug.cgi?id=482206
https://bugzilla.redhat.com/show_bug.cgi?id=1000510
http://seclists.org/oss-sec/2013/q3/483


See this note in RAW Version
Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}
Copyright 2024, cxsecurity.com

 

Back to Top