Bug 423271 (CVE-2007-6321)
| Summary: | CVE-2007-6321 roundcubemail: XSS vulnerability | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Tomas Hoger <thoger> |
| Component: | vulnerability | Assignee: | Gwyn Ciesla <gwync> |
| Status: | CLOSED ERRATA | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | gwync, security-response-team |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| URL: | http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-6321 | ||
| Whiteboard: | |||
| Fixed In Version: | 0.2-0.alpha.fc8 | Doc Type: | Bug Fix |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2008-06-14 05:42:51 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 423281, 423291, 423301 | ||
| Bug Blocks: | |||
|
Description
Tomas Hoger
2007-12-13 12:30:36 UTC
Still no update, contacting upstream. No reply, added comment to appropriate upstream bug: http://trac.roundcube.net/ticket/1484701 Apparently claims fixed in rc2, verifying. Jon, have you managed to verify this really is fixed in 0.1. Looking at the upstream ticket, comments suggest this is not fully fixed there and fix is postponed until 0.1.1 or 0.2. You are correct. I should have looked more closely. roundcubemail-0.1-1.fc8 has been pushed to the Fedora 8 testing repository. If problems still persist, please make note of it in this bug report. If you want to test the update, you can install it with su -c 'yum --enablerepo=updates-testing update roundcubemail'. You can provide feedback for this update here: http://admin.fedoraproject.org/updates/F8/FEDORA-2008-2962 0.2-alpha released upstream, addressing this vulnerability, but no -dependant package is available yet. I have contacted upstream to expedite this. roundcubemail-0.2-0.alpha.fc7.1 has been submitted as an update for Fedora 7 roundcubemail-0.2-0.alpha.fc7.1 has been pushed to the Fedora 7 stable repository. If problems still persist, please make note of it in this bug report. roundcubemail-0.2-0.alpha.fc9 has been pushed to the Fedora 9 stable repository. If problems still persist, please make note of it in this bug report. roundcubemail-0.2-0.alpha.fc8 has been pushed to the Fedora 8 stable repository. If problems still persist, please make note of it in this bug report. |