Bug 488994

Summary:	<mail-client/roundcube-{0.8.7,0.9.5}: random file access, manipulated SQL queries and even code execution (CVE-2013-6172)
Product:	Gentoo Security	Reporter:	Alex Xu (Hello71) <alex_y_xu>
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	RESOLVED DUPLICATE
Severity:	major	CC:	web-apps
Priority:	Normal
Version:	unspecified
Hardware:	All
OS:	Linux
URL:	http://roundcube.net/news/2013/10/21/security-updates-095-and-087/
Whiteboard:	B1 [ebuild]
Package list:		Runtime testing required:	---

Description Alex Xu (Hello71) 2013-10-22 11:20:08 UTC

We just published new releases which fix a recently reported vulnerability that allows an attacker to overrwrite configuration settings using user preferences. This can result in random file access, manipulated SQL queries and even code execution. The latter one only affects versions 0.8.6 and older.

[ ... ]

More information about this vulnerability will be published under CVE-2013-6172.

Comment 1 Agostino Sarubbo gentoo-dev

2013-10-22 12:23:50 UTC


*** This bug has been marked as a duplicate of bug 488954 ***