Bug 434378 – <mail-client/roundcube-0.8.1: Multiple XSS vulnerabilities (CVE-2012-{3507,3508,4668})

• Product: Gentoo Security
• Status: RESOLVED FIXED

[Description GLSAMaker/CVETool Bot 2012-09-08 23:31:45 UTC]

CVE-2012-4668 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-4668):
  Cross-site scripting (XSS) vulnerability in Roundcube Webmail 0.8.1 and
  earlier allows remote attackers to inject arbitrary web script or HTML via
  the signature in an email.

CVE-2012-3508 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-3508):
  Cross-site scripting (XSS) vulnerability in program/lib/washtml.php in
  Roundcube Webmail 0.8.0 allows remote attackers to inject arbitrary web
  script or HTML by using "javascript:" in an href attribute in the body of an
  HTML-formatted email.

CVE-2012-3507 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-3507):
  Cross-site scripting (XSS) vulnerability in program/steps/mail/func.inc in
  RoundCube Webmail before 0.8.0, when using the Larry skin, allows remote
  attackers to inject arbitrary web script or HTML via the email message
  subject.


Note that the wording in CVE-2012-4668 is confusing: upstream states that the issues were fixed for 0.8.x in 0.8.1. However, they did not backport the fix to the 0.7.x branch.

@web-apps: may we stabilize 0.8.1?

[Comment 1 Tim Harder 2012-09-15 07:16:26 UTC]

> @web-apps: may we stabilize 0.8.1?

Go ahead.

[Comment 2 Sean Amoss (RETIRED) 2012-09-15 13:42:24 UTC]

(In reply to comment #1)
> > @web-apps: may we stabilize 0.8.1?
> 
> Go ahead.

Thanks, Tim.

Arches, please test and mark stable:
=mail-client/roundcube-0.8.1

[Comment 3 Agostino Sarubbo 2012-09-15 15:06:41 UTC]

amd64 stable

[Comment 4 Andreas Schürch 2012-09-18 04:50:49 UTC]

x86 done.

[Comment 5 Markus Meier 2012-10-02 21:43:43 UTC]

arm stable

[Comment 6 Agostino Sarubbo 2012-11-29 16:20:13 UTC]

ppc stable

[Comment 7 Sean Amoss (RETIRED) 2012-11-29 16:36:15 UTC]

Thanks, everyone.

Closing noglsa for XSS issues.