Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Sun, 26 Aug 2012 23:32:00 +0400
From: Eygene Ryabinkin <>
Cc: Henri Salo <>, Moritz Muehlenhoff <>
Subject: Re: CVE-request: Roundcube XSS issues

Mon, Aug 20, 2012 at 10:11:28AM -0600, Kurt Seifried wrote:
> On 08/20/2012 05:24 AM, Jan Lieskovsky wrote:
> > Upon code review, I don't think this issue affects 0.7.x versions, 
> > we ship in Fedora and EPEL (iilc the Larry skin was introduced
> > only in 0.8.x version and in 0.7.x version the related code looks 
> > different).

That's true: the issue is that the $hkey was used in the ternary
operator (copy'n'paste error) and $hkey wasn't initialized at the
point, so the condition will be false, thus the 'show' mode will be
used.  And this code appears only in 0.8-beta and 0.8-rc.  0.8.0 fixes
the issue and it doesn't exist in the 0.7.x, because there were no
processing for the 'valueof' attribute in rcmail_message_headers().

> > I don't have filed RH bug for this based on the above. 
> > Could you have a look and confirm this?
> Please use CVE-2012-3507 for this issue.

At NVD I see that version specification is "prior to 0.8.0",
shows only a stub without details.  The proper version specification
will be "Roundcube from 0.8.x series prior to 0.8.0".

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.