• [SECURITY] [DSA 5531-1] roundcube security update

    From Sebastien Delafond@21:1/5 to All on Mon Oct 23 08:50:01 2023
    Hash: SHA512

    - ------------------------------------------------------------------------- Debian Security Advisory DSA-5531-1 security@debian.org https://www.debian.org/security/ Sebastien Delafond October 23, 2023 https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package : roundcube
    CVE ID : CVE-2023-5631
    Debian Bug : 1054079

    It was discovered that roundcube, a skinnable AJAX based webmail
    solution for IMAP servers, did not properly sanitize HTML
    messages. This would allow an attacker to load arbitrary JavaScript

    For the oldstable distribution (bullseye), this problem has been fixed
    in version 1.4.15+dfsg.1-1~deb11u1.

    For the stable distribution (bookworm), this problem has been fixed in
    version 1.6.4+dfsg-1~deb12u1.

    We recommend that you upgrade your roundcube packages.

    For the detailed security status of roundcube please refer to
    its security tracker page at: https://security-tracker.debian.org/tracker/roundcube

    Further information about Debian Security Advisories, how to apply
    these updates to your system and frequently asked questions can be
    found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

    iQEzBAEBCgAdFiEEAqSkbVtrXP4xJMh3EL6Jg/PVnWQFAmU2FhEACgkQEL6Jg/PV nWTgbQf/T08r3SQ/NFUpzs1/8k+euPOyysNFnW7JZ1LcI+ug5iF8RrdEVVuURZHK 7i/SuRNomgEQbUyVpgSb9rb6z5qkc0k6gbfh2+KMRk0ViHhG1+tuEe1O99abXt+5 LUQNtXWVMAniWWdbtdQeCBHWgxMpstarWq4akgCnx1Dj7Tj8PyX05+bYFpR79WMq CKypX4lz1kP8U3U5c0tPDi/zjuzGT1IvVSyWPesaNHzmD4ZMr9A/dcDBtxQ+kTaP N3GVPJoDG9TVOcHQTqcb2MmTQY5FtvQswVCXiEsugbmgOQ4wiUYlV90C8s4ALSxB Biv+mOUCKZH/mNNjNeHKADW+nOkOeg==
    -----END PGP SIGNATURE-----

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)