DEBIAN-CVE-2023-5631

Roundcube before 1.4.15, 1.5.x before 1.5.5, and 1.6.x before 1.6.4 allows stored XSS via an HTML e-mail message with a crafted SVG document because of program/lib/Roundcube/rcube_washtml.php behavior. This could allow a remote attacker to load arbitrary JavaScript code.

References

https://security-tracker.debian.org/tracker/CVE-2023-5631

Affected packages

Debian:12 / roundcube

Package

Name: roundcube
Purl: pkg:deb/debian/roundcube?arch=source&distro=bookworm

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

1.6.4+dfsg-1~deb12u1

Affected versions

1.*

1.6.1+dfsg-1

1.6.2+dfsg-1

1.6.3+dfsg-1~deb12u1

1.6.3+dfsg-1

1.6.3+dfsg-2

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Database specific

source

"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2023-5631.json"

Debian:13 / roundcube

Package

Name: roundcube
Purl: pkg:deb/debian/roundcube?arch=source&distro=trixie

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

1.6.4+dfsg-1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Database specific

source

"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2023-5631.json"

Debian:14 / roundcube

Package

Name: roundcube
Purl: pkg:deb/debian/roundcube?arch=source&distro=forky

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

1.6.4+dfsg-1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Database specific

source

"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2023-5631.json"