Common Vulnerabilities and Exposures assigned an identifier CVE-2008-5620 to the following vulnerability: RoundCube Webmail (roundcubemail) before 0.2-beta allows remote attackers to cause a denial of service (memory consumption) via crafted size parameters that are used to create a large quota image. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5620 http://sourceforge.net/forum/forum.php?forum_id=898542 Upstream patch: http://downloads.sourceforge.net/roundcubemail/roundcubemail-0.2-beta-patch.tar.gz
Created attachment 327236 [details] Upstream patch
This issue affects all versions of the Roundcubemail package, as shipped with Fedora releases of 9, 10 and devel.
Created attachment 327238 [details] /bin/html2text.php diff part extracted from upstream patch.
Created attachment 327240 [details] /bin/quotaimg.php diff extracted from the upstream patch
Created attachment 327267 [details] Downloaded upstream patch.
These patches are reflected in the current version, 0.2-beta. This vulnerability affects per 0.2-beta releases.
Patch in comment #4 does not seem to be, or do I miss anything?
Whoops, bad patch. Fixing. . .
roundcubemail-0.2-5.beta.fc9 has been submitted as an update for Fedora 9. http://admin.fedoraproject.org/updates/roundcubemail-0.2-5.beta.fc9
roundcubemail-0.2-5.beta.fc8 has been submitted as an update for Fedora 8. http://admin.fedoraproject.org/updates/roundcubemail-0.2-5.beta.fc8
roundcubemail-0.2-5.beta.fc10 has been submitted as an update for Fedora 10. http://admin.fedoraproject.org/updates/roundcubemail-0.2-5.beta.fc10
roundcubemail-0.2-5.beta.fc9 has been pushed to the Fedora 9 stable repository. If problems still persist, please make note of it in this bug report.
roundcubemail-0.2-5.beta.fc8 has been pushed to the Fedora 8 stable repository. If problems still persist, please make note of it in this bug report.
roundcubemail-0.2-5.beta.fc10 has been pushed to the Fedora 10 stable repository. If problems still persist, please make note of it in this bug report.
This issue was addressed in: Fedora: https://admin.fedoraproject.org/updates/F10/FEDORA-2008-11456 https://admin.fedoraproject.org/updates/F8/FEDORA-2008-11581 https://admin.fedoraproject.org/updates/F9/FEDORA-2008-11535