[<prev] [next>] [day] [month] [year] [list]
Message-ID: <q4worg73f2pve6qws3mllfepjw6l4rbidw5nr7ltuuqk2otpro@6hl4ptg26an7>
Date: Mon, 12 Aug 2024 15:56:14 +0300
From: Valtteri Vuorikoski <vuori@...com.org>
To: oss-security@...ts.openwall.com
Subject: CVE-2024-42008 and more: XSS vulnerabilities in Roundcube webmail
Not associated with Roundcube but didn't see posts about this yet.
On August 4, the Roundcube project released versions 1.6.8 and 1.5.8 (LTS) of
their webmail client with fixes for several XSS vulnerabilities in HTML e-mail
display. From the announcement page at
<https://roundcube.net/news/2024/08/04/security-updates-1.6.8-and-1.5.8>:
Fix XSS vulnerability in post-processing of sanitized HTML content [CVE-2024-42009]
Fix XSS vulnerability in serving of attachments other than HTML or SVG [CVE-2024-42008]
Fix information leak (access to remote content) via insufficient CSS filtering [CVE-2024-42010]
Links to both releases are on the abovementioned page.
-Valtteri
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
