Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 564476 (CVE-2015-8105) - <mail-client/roundcube-1.1.3: Multiple Vulnerabilities (CVE-2015-8105)
Summary: <mail-client/roundcube-1.1.3: Multiple Vulnerabilities (CVE-2015-8105)
Status: RESOLVED FIXED
Alias: CVE-2015-8105
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal minor (vote)
Assignee: Gentoo Security
URL: https://bugzilla.redhat.com/show_bug....
Whiteboard: B4 [glsa]
Keywords:
: 565204 (view as bug list)
Depends on: 571920
Blocks:
  Show dependency tree
 
Reported: 2015-10-30 08:49 UTC by Agostino Sarubbo
Modified: 2016-03-09 09:32 UTC (History)
6 users (show)

See Also:
Package list:
Runtime testing required: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Agostino Sarubbo gentoo-dev 2015-10-30 08:49:33 UTC
From ${URL} :

An XSS vulnerability in roundcubemail was found when drag-n-dropping a file with crafted filename, 
e.g. '><img src=x onerror=alert(1);>.

Upstream bug:

http://trac.roundcube.net/ticket/1490530

Upstream patch:

http://trac.roundcube.net/changeset/dd7db2179/github


@maintainer(s): after the bump, in case we need to stabilize the package, please let us know if it is ready for the stabilization or not.
Comment 1 Aaron W. Swenson gentoo-dev 2015-12-09 12:58:01 UTC
I'll add arches in a day or so to make sure no issues crop up.

commit c20f39cdcba8d3f75fcd7d6c09e80d2ee0655e40
Author: Aaron W. Swenson <titanofold@gentoo.org>
Date:   Wed Dec 9 07:44:37 2015 -0500

    mail-client/roundcube: Version bump, security, and bug fixes
    
    Added two use flags controlling optional dependencies to support the
    enigma and and sieverules plugins.
    
    Added REQUIRED_USE as one of postgres, mysql, or sqlite must be
    enabled. Rouncube requires a database to operate. As the ebuild uses
    this now, removed the default enable on the mysql USE flag.
    
    Added POST-UPGRADE.txt which is just a shortened version of the
    UPGRADE text from upstream.
    
    Dropped arm and ppc64 keywords as one dependency,
    dev-php/PEAR-Net_LDAP2, currently lacks matching keywords for those
    architectures.
    
    Bug: 541172, 545096, 524192, 564476, 565204, 53284
    
    Package-Manager: portage-2.2.20.1
Comment 2 Aaron W. Swenson gentoo-dev 2015-12-10 13:46:20 UTC
I made a typo in my previous commit. The last bug number is 532844.
Comment 3 Aaron W. Swenson gentoo-dev 2015-12-10 13:47:07 UTC
*** Bug 565204 has been marked as a duplicate of this bug. ***
Comment 4 Aaron W. Swenson gentoo-dev 2015-12-10 13:48:06 UTC
Arch teams, stabilization target is:

=mail-client/roundcube-1.1.3

Thank you.
Comment 5 Yury German Gentoo Infrastructure gentoo-dev 2015-12-11 04:39:57 UTC
(In reply to Aaron W. Swenson from comment #4)
> Arch teams, stabilization target is:
> 
> =mail-client/roundcube-1.1.3

Questions about the Keywords for this 1.1.3 is:
+KEYWORDS="~amd64 ~hppa ~ppc ~sparc ~x86"

Previous Builds have keywords of:
KEYWORDS="amd64 arm ~hppa ppc ~ppc64 ~sparc x86"
So we are missing (arm, ~ppc64). Are we removing them?
Comment 6 Mikle Kolyada archtester Gentoo Infrastructure gentoo-dev Security 2015-12-11 10:54:20 UTC
>>> Creating Manifest for /home/zlogene/gentoo/mail-client/roundcube                                                                                                                                                                         
  dependency.bad [fatal]        25                                                                                                                                                                                                           
   mail-client/roundcube/roundcube-1.1.3.ebuild: RDEPEND: amd64(default/linux/amd64/13.0)                                                                                                                                                    
['>=dev-php/PEAR-Mail_Mime-1.8.9']                                                                                                                                                                                                           
   mail-client/roundcube/roundcube-1.1.3.ebuild: RDEPEND: amd64(default/linux/amd64/13.0/desktop)                                                                                                                                            
['>=dev-php/PEAR-Mail_Mime-1.8.9']                                                                                                                                                                                                           
   mail-client/roundcube/roundcube-1.1.3.ebuild: RDEPEND: amd64(default/linux/amd64/13.0/desktop/gnome)                                                                                                                                      
['>=dev-php/PEAR-Mail_Mime-1.8.9']                                                                                                                                                                                                           
   mail-client/roundcube/roundcube-1.1.3.ebuild: RDEPEND: amd64(default/linux/amd64/13.0/desktop/gnome/systemd)                                                                                                                              
['>=dev-php/PEAR-Mail_Mime-1.8.9']                                                                                                                                                                                                           
   mail-client/roundcube/roundcube-1.1.3.ebuild: RDEPEND: amd64(default/linux/amd64/13.0/desktop/kde)                                                                                                                                        
['>=dev-php/PEAR-Mail_Mime-1.8.9']                                                                                                                                                                                                           
   mail-client/roundcube/roundcube-1.1.3.ebuild: RDEPEND: amd64(default/linux/amd64/13.0/desktop/kde/systemd)                                                                                                                                
['>=dev-php/PEAR-Mail_Mime-1.8.9']                                                                                                                                                                                                           
   mail-client/roundcube/roundcube-1.1.3.ebuild: RDEPEND: amd64(default/linux/amd64/13.0/desktop/plasma)                                                                                                                                     
['>=dev-php/PEAR-Mail_Mime-1.8.9']                                                                                                                                                                                                           
   mail-client/roundcube/roundcube-1.1.3.ebuild: RDEPEND: amd64(default/linux/amd64/13.0/desktop/plasma/systemd)                                                                                                                             
['>=dev-php/PEAR-Mail_Mime-1.8.9']                                                                                                                                                                                                           
   mail-client/roundcube/roundcube-1.1.3.ebuild: RDEPEND: amd64(default/linux/amd64/13.0/developer)                                                                                                                                          
['>=dev-php/PEAR-Mail_Mime-1.8.9']                                                                                                                                                                                                           
   mail-client/roundcube/roundcube-1.1.3.ebuild: RDEPEND: amd64(default/linux/amd64/13.0/systemd)
['>=dev-php/PEAR-Mail_Mime-1.8.9']
   mail-client/roundcube/roundcube-1.1.3.ebuild: RDEPEND: x86(default/linux/x86/13.0)
['>=dev-php/PEAR-Mail_Mime-1.8.9']
   mail-client/roundcube/roundcube-1.1.3.ebuild: RDEPEND: x86(default/linux/x86/13.0/desktop)
['>=dev-php/PEAR-Mail_Mime-1.8.9']
Comment 7 Aaron W. Swenson gentoo-dev 2015-12-11 11:22:01 UTC
(In reply to Yury German from comment #5)
> (In reply to Aaron W. Swenson from comment #4)
> > Arch teams, stabilization target is:
> > 
> > =mail-client/roundcube-1.1.3
> 
> Questions about the Keywords for this 1.1.3 is:
> +KEYWORDS="~amd64 ~hppa ~ppc ~sparc ~x86"
> 
> Previous Builds have keywords of:
> KEYWORDS="amd64 arm ~hppa ppc ~ppc64 ~sparc x86"
> So we are missing (arm, ~ppc64). Are we removing them?

Yes, as I mentioned in the commit message, but should have reiterated, dev-php/PEAR-Net_LDAP2, which is one of the optional dependencies, currently lacks matching keywords for those architectures.

I don't know how or why the previous versions of roundcube were stabilized given that the arm and ppc64 weren't dropped from dev-php/PEAR-Net_LDAP2 and older versions of roundcube have it as a dependency.

(In reply to Mikle Kolyada from comment #6)
> >>> Creating Manifest for /home/zlogene/gentoo/mail-client/roundcube              
>   dependency.bad [fatal]        25                                          
> 
>    mail-client/roundcube/roundcube-1.1.3.ebuild: RDEPEND:
> amd64(default/linux/amd64/13.0)                                             
> 
> ['>=dev-php/PEAR-Mail_Mime-1.8.9']                                          
> 
>    mail-client/roundcube/roundcube-1.1.3.ebuild: RDEPEND:
> amd64(default/linux/amd64/13.0/desktop)                                     

I forgot about that. I've opened another bug to get dev-php/PEAR-Mail_Mime-1.9.0 stabled.
Comment 8 Tim Harder gentoo-dev 2015-12-11 18:52:10 UTC
Just to note, this is one reason why I often maintain(ed) both the old and newer upstream versions (in this case 1.0.7 and 1.1.3). That way 1.0.7 should be able to go stable quickly since it doesn't have any new deps and 1.1.3 can sit and get more testing.
Comment 9 Tim Harder gentoo-dev 2015-12-11 19:01:10 UTC
(In reply to Aaron W. Swenson from comment #7)
> Yes, as I mentioned in the commit message, but should have reiterated,
> dev-php/PEAR-Net_LDAP2, which is one of the optional dependencies, currently
> lacks matching keywords for those architectures.
> 
> I don't know how or why the previous versions of roundcube were stabilized
> given that the arm and ppc64 weren't dropped from dev-php/PEAR-Net_LDAP2 and
> older versions of roundcube have it as a dependency.

At some point either I or someone else obviously missed it.

Regarding your REQUIRED_USE change, you should still have a default choice selected for the db backend. That way things like `ebuild fetch` work by default and people doing automated tinderbox tests don't have to make choices.
Comment 10 Craig Inches 2015-12-13 15:23:01 UTC
Fresh install with nothing pre-installed(mysql/apache/php) the ebuild pulls in php without the apache2 flag so there is no apache php module.
Comment 11 Tony Vroon gentoo-dev 2015-12-14 07:26:00 UTC
(In reply to Craig from comment #10)
> Fresh install with nothing pre-installed(mysql/apache/php) the ebuild pulls
> in php without the apache2 flag so there is no apache php module.

Separate bug will be filed, not blocking security stable. No further comment required (AMD64 arch test mentor).
Comment 12 Jeroen Roovers (RETIRED) gentoo-dev 2015-12-18 12:06:10 UTC
Why is HPPA CC'd here?
Comment 13 Aaron W. Swenson gentoo-dev 2015-12-18 15:14:56 UTC
(In reply to Jeroen Roovers from comment #12)
> Why is HPPA CC'd here?

Because HPPA isn't shown as an unstable architecture in Bugzilla, and it has a keyword in this package. However, I'm seeing that sparc hasn't been stabled on this package either. Is there a reason HPPA and sparc shouldn't be CC'd and that we shouldn't stable on those arches?
Comment 14 Jeroen Roovers (RETIRED) gentoo-dev 2015-12-18 15:21:28 UTC
Architectures with only unstable keywords on a package don't get security treatment.
Comment 15 Agostino Sarubbo gentoo-dev 2015-12-24 20:12:16 UTC
amd64 stable
Comment 16 Agostino Sarubbo gentoo-dev 2015-12-25 18:21:19 UTC
x86 stable
Comment 17 Agostino Sarubbo gentoo-dev 2015-12-26 10:56:39 UTC
ppc stable
Comment 18 Craig Andrews gentoo-dev 2015-12-29 05:26:55 UTC
Additional vulnerabilities have been found. The newly released version 1.1.4 fixes these issues: https://roundcube.net/news/2015/12/26/updates-1.1.4-and-1.0.8-released/
Comment 19 Yury German Gentoo Infrastructure gentoo-dev 2015-12-31 07:25:17 UTC
New Bug has been created for the vulnerability (Bug # 570336), set as dependency.
Comment 20 Yury German Gentoo Infrastructure gentoo-dev 2015-12-31 07:25:53 UTC
My fault, should of been blocker
Comment 21 Aaron W. Swenson gentoo-dev 2016-01-14 18:57:14 UTC
commit 8a3bcf93eba9de75950be6b0cf1c09b3edf36171
Author: Aaron W. Swenson <titanofold@gentoo.org>
Date:   Thu Jan 14 13:45:54 2016 -0500

    mail-client/roundcube: Version Bump
    
    Version bump fixes bug 570834 and addresses multiple security bugs.
    
    Bug: 570834,564476,570336
    
    Package-Manager: portage-2.2.20.1

Stabilization targets:
=mail-client/roundcube-1.1.4 ~amd64 ~hppa ~ppc ~sparc ~x86

Stabilization targets pending resolution of 571920:
=mail-client/roundcube-1.1.4 ~arm ~ppc64
Comment 22 Markus Meier gentoo-dev 2016-01-17 14:09:12 UTC
arm stable, all arches done.
Comment 23 Aaron W. Swenson gentoo-dev 2016-01-21 13:56:57 UTC
commit fddb2b8c50395843639b43ea9a908a94bc887924
Author: Aaron W. Swenson <titanofold@gentoo.org>
Date:   Thu Jan 21 08:51:17 2016 -0500

    mail-client/roundcube: Remove Insecure Versions
    
    Removed insecure versions 1.0.5, 1.0.6, and 1.1.3.
    
    Bug: 554866, 564476, 570336
    
    Package-Manager: portage-2.2.26
Comment 24 Aaron Bauman Gentoo Infrastructure gentoo-dev Security 2016-03-05 09:20:33 UTC
Assigned to GLSA 74a1a7303
Comment 25 GLSAMaker/CVETool Bot gentoo-dev 2016-03-09 09:32:32 UTC
This issue was resolved and addressed in
 GLSA 201603-03 at https://security.gentoo.org/glsa/201603-03
by GLSA coordinator Sergey Popov (pinkbyte).