Bug 476223 (CVE-2008-5619)
| Summary: | CVE-2008-5619 roundcubemail: Remotely exploitable code injection vulnerability | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Jan Lieskovsky <jlieskov> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED CURRENTRELEASE | QA Contact: | |
| Severity: | high | Docs Contact: | |
| Priority: | high | ||
| Version: | unspecified | CC: | gwync |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| URL: | http://trac.roundcube.net/changeset/2148 | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | Bug Fix | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2008-12-17 15:10:04 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
|
Description
Jan Lieskovsky
2008-12-12 15:57:55 UTC
This issue affects all versions of the roundcubemail package, as shipped with Fedora releases of 8, 9 and 10. Please apply the above patch and update. roundcubemail-0.2-4.beta.fc10 has been submitted as an update for Fedora 10. http://admin.fedoraproject.org/updates/roundcubemail-0.2-4.beta.fc10 roundcubemail-0.2-4.beta.fc9 has been submitted as an update for Fedora 9. http://admin.fedoraproject.org/updates/roundcubemail-0.2-4.beta.fc9 roundcubemail-0.2-4.beta.fc8 has been submitted as an update for Fedora 8. http://admin.fedoraproject.org/updates/roundcubemail-0.2-4.beta.fc8 roundcubemail-0.2-4.beta.fc8 has been pushed to the Fedora 8 stable repository. If problems still persist, please make note of it in this bug report. roundcubemail-0.2-4.beta.fc9 has been pushed to the Fedora 9 stable repository. If problems still persist, please make note of it in this bug report. roundcubemail-0.2-4.beta.fc10 has been pushed to the Fedora 10 stable repository. If problems still persist, please make note of it in this bug report. Common Vulnerabilities and Exposures assigned an identifier CVE-2008-5619 to this vulnerability: html2text.php in RoundCube Webmail (roundcubemail) 0.2-1.alpha and 0.2-3.beta allows remote attackers to execute arbitrary code via crafted input that is processed by the preg_replace function with the eval switch. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5619 http://trac.roundcube.net/ticket/1485618 http://sourceforge.net/forum/forum.php?forum_id=898542 http://trac.roundcube.net/changeset/2148 https://www.redhat.com/archives/fedora-package-announce/2008-December/msg00783.html https://www.redhat.com/archives/fedora-package-announce/2008-December/msg00802.html http://www.openwall.com/lists/oss-security/2008/12/12/1 http://secunia.com/advisories/33170 |