Common Vulnerabilities and Exposures assigned an identifier CVE-2007-6321 to the following vulnerability: Cross-site scripting (XSS) vulnerability in RoundCube webmail 0.1rc2, 2007-12-09, and earlier versions, when using Internet Explorer, allows remote attackers to inject arbitrary web script or HTML via style sheets containing expression commands. References: http://www.securityfocus.com/archive/1/archive/1/484802/100/0/threaded http://openmya.hacker.jp/hasegawa/security/expression.txt http://xforce.iss.net/xforce/xfdb/38981
Still no update, contacting upstream.
No reply, added comment to appropriate upstream bug: http://trac.roundcube.net/ticket/1484701 Apparently claims fixed in rc2, verifying.
Jon, have you managed to verify this really is fixed in 0.1. Looking at the upstream ticket, comments suggest this is not fully fixed there and fix is postponed until 0.1.1 or 0.2.
You are correct. I should have looked more closely.
roundcubemail-0.1-1.fc8 has been pushed to the Fedora 8 testing repository. If problems still persist, please make note of it in this bug report. If you want to test the update, you can install it with su -c 'yum --enablerepo=updates-testing update roundcubemail'. You can provide feedback for this update here: http://admin.fedoraproject.org/updates/F8/FEDORA-2008-2962
0.2-alpha released upstream, addressing this vulnerability, but no -dependant package is available yet. I have contacted upstream to expedite this.
roundcubemail-0.2-0.alpha.fc7.1 has been submitted as an update for Fedora 7
roundcubemail-0.2-0.alpha.fc7.1 has been pushed to the Fedora 7 stable repository. If problems still persist, please make note of it in this bug report.
roundcubemail-0.2-0.alpha.fc9 has been pushed to the Fedora 9 stable repository. If problems still persist, please make note of it in this bug report.
roundcubemail-0.2-0.alpha.fc8 has been pushed to the Fedora 8 stable repository. If problems still persist, please make note of it in this bug report.
This issue was addressed in: Fedora: https://admin.fedoraproject.org/updates/F7/FEDORA-2008-5315 https://admin.fedoraproject.org/updates/F8/FEDORA-2008-5342 https://admin.fedoraproject.org/updates/F9/FEDORA-2008-5333