CVE-2024-42010

modcssstyles in Roundcube through 1.5.7 and 1.6.x through 1.6.7 insufficiently filters Cascading Style Sheets (CSS) token sequences in rendered e-mail messages, allowing a remote attacker to obtain sensitive information.

References

Affected packages

Git / github.com/roundcube/roundcubemail

Affected ranges

Type

GIT

Repo

https://github.com/roundcube/roundcubemail

Events

Introduced

Last affected

545365ccf7fb87d23015b92a3d96dde58f5ce984

Introduced

993b888afe29c383bf45c84f17090f4db96367ba

Last affected

43aaaa528646877789ec028d87924ba1accf5242

Fixed

ed988390312e0ad16843dbd1eb7a1e82241545d2

Fixed

44ed0d6fb0cefe30c9c7892c61c34a21a7213c56

Database specific

{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "1.5.7"
        },
        {
            "introduced": "1.6.x"
        },
        {
            "last_affected": "1.6.7"
        }
    ]
}

Affected versions

0.*

0.7.4

0.8.6

0.9-rc2

1.*

1.0.0

1.0.1

1.0.10

1.0.11

1.0.12

1.0.2

1.0.3

1.0.4

1.0.5

1.0.6

1.0.7

1.0.8

1.0.9

1.1-beta

1.1-rc

1.1.0

1.1.1

1.1.10

1.1.11

1.1.12

1.1.2

1.1.3

1.1.4

1.1.5

1.1.6

1.1.7

1.1.8

1.1.9

1.2-beta

1.2-rc

1.2.0

1.2.1

1.2.10

1.2.11

1.2.12

1.2.13

1.2.2

1.2.3

1.2.4

1.2.5

1.2.6

1.2.7

1.2.8

1.2.9

1.3-beta

1.3-rc

1.3.0

1.3.1

1.3.10

1.3.11

1.3.12

1.3.13

1.3.14

1.3.15

1.3.16

1.3.17

1.3.2

1.3.3

1.3.4

1.3.5

1.3.6

1.3.7

1.3.8

1.3.9

1.4-beta

1.4-rc1

1.4-rc2

1.4.0

1.4.1

1.4.10

1.4.11

1.4.12

1.4.13

1.4.14

1.4.15

1.4.16

1.4.2

1.4.3

1.4.4

1.4.5

1.4.6

1.4.7

1.4.8

1.4.9

1.5-beta

1.5-rc

1.5.0

1.5.1

1.5.2

1.5.3

1.5.4

1.5.5

1.5.6

1.5.7

1.6-beta

1.6-rc

1.6.0

1.6.1

1.6.2

1.6.3

1.6.4

1.6.5

1.6.6

1.6.7

1.7-beta

1.7-beta2

1.7-rc

1.7-rc2

1.7-rc3

1.7-rc4

1.7-rc5

1.7-rc6

v0.*

v0.1-beta2

v0.1-rc1

v0.1-rc1@582

v0.1-rc2

v0.1-rc2@900

v0.1-stable

v0.1-stable@1183

v0.1.1

v0.1.1@1258

v0.2-alpha

v0.2-alpha@1499

v0.2-beta

v0.2-beta@1877

v0.2-beta@1878

v0.2-stable

v0.2-stable@2204

v0.2.1

v0.2.1@2348

v0.2.2

v0.2.2@2481

v0.2.2@2495

v0.3-beta

v0.3-beta@2799

v0.3-rc1

v0.3-stable

v0.3-stable@2921

v0.3.1

v0.3.1@3081

v0.4-beta

v0.4-beta@3548

v0.4.1

v0.4.1@4045

v0.4.2

v0.4.2@4050

v0.5

v0.5-beta

v0.5-beta@4347

v0.5-rc

v0.5-rc@4349

v0.5.1

v0.5.1@4518

v0.5.2

v0.5.2@4679

v0.5.3

v0.5.3@4832

v0.5.4

v0.5.4@5062

v0.5.4@5065

v0.5@4408

v0.6

v0.6-beta

v0.6-rc

v0.7

v0.7-beta1

v0.7-beta2

v0.7.1

v0.7.2

v0.7.3

v0.7.4

v0.8-beta

v0.8-rc

v0.8.0

v0.8.1

v0.8.2

v0.8.3

v0.8.4

v0.8.5

v0.8.6

v0.8.7

v0.9-beta

v0.9-rc

v0.9-rc2

v0.9.0

v0.9.1

v0.9.2

v0.9.3

v0.9.4

v0.9.5

v1.*

v1.0-beta

v1.0-rc

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-42010.json"