Bug 830666 (CVE-2021-46144)

Summary:	<mail-client/roundcube-1.5.2: XSS via crafted CSS
Product:	Gentoo Security	Reporter:	John Helmert III <ajak>
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	RESOLVED FIXED
Severity:	minor	CC:	candrews, hydrapolic, titanofold, web-apps
Priority:	Normal
Version:	unspecified
Hardware:	All
OS:	Linux
Whiteboard:	B4 [noglsa]
Package list:		Runtime testing required:	---
Bug Depends on:	830889
Bug Blocks:

Description John Helmert III archtester

2022-01-06 07:36:03 UTC

CVE-2021-46144:

Roundcube before 1.4.13 and 1.5.x before 1.5.2 allows XSS via an HTML e-mail message with crafted Cascading Style Sheets (CSS) token sequences.

https://roundcube.net/news/2021/12/30/update-1.5.2-released
https://roundcube.net/news/2021/12/30/security-update-1.4.13-released

Please bump to 1.4.13 and cleanup the 1.5.x versions.