Red Hat Bugzilla – Bug 423271
CVE-2007-6321 roundcubemail: XSS vulnerability
Last modified: 2016-03-04 07:24:08 EST
Common Vulnerabilities and Exposures assigned an identifier CVE-2007-6321 to the following vulnerability:
Cross-site scripting (XSS) vulnerability in RoundCube webmail 0.1rc2,
2007-12-09, and earlier versions, when using Internet Explorer, allows remote
attackers to inject arbitrary web script or HTML via style sheets containing
Still no update, contacting upstream.
No reply, added comment to appropriate upstream bug:
Apparently claims fixed in rc2, verifying.
Jon, have you managed to verify this really is fixed in 0.1. Looking at the
upstream ticket, comments suggest this is not fully fixed there and fix is
postponed until 0.1.1 or 0.2.
You are correct. I should have looked more closely.
roundcubemail-0.1-1.fc8 has been pushed to the Fedora 8 testing repository. If problems still persist, please make note of it in this bug report.
If you want to test the update, you can install it with
su -c 'yum --enablerepo=updates-testing update roundcubemail'. You can provide feedback for this update here: http://admin.fedoraproject.org/updates/F8/FEDORA-2008-2962
0.2-alpha released upstream, addressing this vulnerability, but no -dependant
package is available yet. I have contacted upstream to expedite this.
roundcubemail-0.2-0.alpha.fc7.1 has been submitted as an update for Fedora 7
roundcubemail-0.2-0.alpha.fc7.1 has been pushed to the Fedora 7 stable repository. If problems still persist, please make note of it in this bug report.
roundcubemail-0.2-0.alpha.fc9 has been pushed to the Fedora 9 stable repository. If problems still persist, please make note of it in this bug report.
roundcubemail-0.2-0.alpha.fc8 has been pushed to the Fedora 8 stable repository. If problems still persist, please make note of it in this bug report.
This issue was addressed in: