Dear Roundcube users
We just published new releases which fix a recently reported
vulnerability that allows an attacker to overwrite configuration
settings using user preferences. This can result in random file
access, manipulated SQL queries and even code execution. The latter
one only affects versions 0.8.6 and older.
Beside the security fix, the 0.9.5 release also includes other minor
bug fixes and improvements. Most notably it brings the default spell
checker back after Google suspended their public spell checking
Please update your installations with the new versions or patch them
with the fixes listed below for the various older versions of
Download the new versions from http://roundcube.net/download
Patch for 0.9.x:
Patch for 0.8.x:
Patch for 0.7.x:
More information about the vulnerability will be published under CVE-2013-6172.
*** Bug 488994 has been marked as a duplicate of this bug. ***
Created attachment 361858 [details]
roundcube 0.8.7 ebuild
ebuild for roundcube 0.8.7; copied from 0.8.6
Created attachment 361860 [details]
roundcube 0.9.5 ebuild
ebuild for roundcube 0.9.5; copied from 0.9.4.
(In reply to Andrew Hamilton from comment #3)
> Created attachment 361860 [details]
> roundcube 0.9.5 ebuild
> ebuild for roundcube 0.9.5; copied from 0.9.4.
You really don't need to attach trivially modified ebuilds.
Arches, please stabilize:
All stable, please cleanup
i readed on bugs.g.o there is now webapp-config override configs :(
it was a problem i only thinked wordpress had :(
new bugs ?
If this is not related to the security GLSA or cleanup of old ebuilds, please file a new bug.
steps/utils/save_pref.inc in Roundcube webmail before 0.8.7 and 0.9.x before
0.9.5 allows remote attackers to modify configuration settings via the
_session parameter, which can be leveraged to read arbitrary files, conduct
SQL injection attacks, and execute arbitrary code.
12 Nov 2013; Tim Harder <email@example.com> -roundcube-0.8.6.ebuild,
-roundcube-0.9.2.ebuild, -roundcube-0.9.3.ebuild, -roundcube-0.9.4.ebuild:
Cleanup was done, GLSA request filed, thanks to all
This issue was resolved and addressed in
GLSA 201402-15 at http://security.gentoo.org/glsa/glsa-201402-15.xml
by GLSA coordinator Sergey Popov (pinkbyte).