UBUNTU-CVE-2017-16651

See a problem?

Source

https://ubuntu.com/security/CVE-2017-16651

Import Source

https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2017/UBUNTU-CVE-2017-16651.json

JSON Data

https://api.osv.dev/v1/vulns/UBUNTU-CVE-2017-16651

Related

CVE-2017-16651

Published

2017-11-09T14:29:00Z

Modified

2024-10-15T14:06:07Z

Severity

7.8 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
7.8 (High) CVSS_V3 - CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

[none]

Details

Roundcube Webmail before 1.1.10, 1.2.x before 1.2.7, and 1.3.x before 1.3.3 allows unauthorized access to arbitrary files on the host's filesystem, including configuration files, as exploited in the wild in November 2017. The attacker must be able to authenticate at the target system with a valid username/password as the attack requires an active session. The issue is related to file-based attachment plugins and task=settings&action=upload-display&_from=timezone requests.

References

Affected packages

Ubuntu:Pro:16.04:LTS / roundcube

Package

Name: roundcube
Purl: pkg:deb/ubuntu/roundcube?arch=src?distro=esm-apps/xenial

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

1.*

1.1.1+dfsg.1-2

1.1.2+dfsg.1-5

1.1.3+dfsg.1-1

1.1.4+dfsg.1-1

1.2~beta+dfsg.1-0ubuntu1

1.2~beta+dfsg.1-0ubuntu1+esm1

1.2~beta+dfsg.1-0ubuntu1+esm2

1.2~beta+dfsg.1-0ubuntu1+esm3

1.2~beta+dfsg.1-0ubuntu1+esm4

Ecosystem specific

{
    "ubuntu_priority": "high"
}

Ubuntu:18.04:LTS / roundcube

Package

Name: roundcube
Purl: pkg:deb/ubuntu/roundcube?arch=src?distro=bionic

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.3.6+dfsg.1-1

Affected versions

1.*

1.3.0+dfsg.1-1

1.3.1+dfsg.1-1

1.3.3+dfsg.1-1

1.3.3+dfsg.1-2

Ecosystem specific

{
    "availability": "No subscription required",
    "ubuntu_priority": "high",
    "binaries": [
        {
            "binary_version": "1.3.6+dfsg.1-1",
            "binary_name": "roundcube"
        },
        {
            "binary_version": "1.3.6+dfsg.1-1",
            "binary_name": "roundcube-core"
        },
        {
            "binary_version": "1.3.6+dfsg.1-1",
            "binary_name": "roundcube-mysql"
        },
        {
            "binary_version": "1.3.6+dfsg.1-1",
            "binary_name": "roundcube-pgsql"
        },
        {
            "binary_version": "1.3.6+dfsg.1-1",
            "binary_name": "roundcube-plugins"
        },
        {
            "binary_version": "1.3.6+dfsg.1-1",
            "binary_name": "roundcube-sqlite3"
        }
    ]
}