CVE-2015-8864

Cross-site scripting (XSS) vulnerability in Roundcube Webmail before 1.0.9 and 1.1.x before 1.1.5 allows remote attackers to inject arbitrary web script or HTML via a crafted SVG, a different vulnerability than CVE-2016-4068.
References
Link Resource
http://lists.opensuse.org/opensuse-updates/2016-08/msg00078.html Third Party Advisory
http://lists.opensuse.org/opensuse-updates/2016-08/msg00079.html Third Party Advisory
http://lists.opensuse.org/opensuse-updates/2016-08/msg00095.html Third Party Advisory
https://github.com/roundcube/roundcubemail/commit/40d7342dd9c9bd2a1d613edc848ed95a4d71aa18 Patch Third Party Advisory
https://github.com/roundcube/roundcubemail/issues/4949 Third Party Advisory
https://github.com/roundcube/roundcubemail/releases/tag/1.0.9 Release Notes Third Party Advisory
https://github.com/roundcube/roundcubemail/releases/tag/1.1.5 Release Notes Third Party Advisory
https://github.com/roundcube/roundcubemail/wiki/Changelog#release-115 Release Notes Third Party Advisory
http://lists.opensuse.org/opensuse-updates/2016-08/msg00078.html Third Party Advisory
http://lists.opensuse.org/opensuse-updates/2016-08/msg00079.html Third Party Advisory
http://lists.opensuse.org/opensuse-updates/2016-08/msg00095.html Third Party Advisory
https://github.com/roundcube/roundcubemail/commit/40d7342dd9c9bd2a1d613edc848ed95a4d71aa18 Patch Third Party Advisory
https://github.com/roundcube/roundcubemail/issues/4949 Third Party Advisory
https://github.com/roundcube/roundcubemail/releases/tag/1.0.9 Release Notes Third Party Advisory
https://github.com/roundcube/roundcubemail/releases/tag/1.1.5 Release Notes Third Party Advisory
https://github.com/roundcube/roundcubemail/wiki/Changelog#release-115 Release Notes Third Party Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:opensuse:leap:42.1:*:*:*:*:*:*:*
cpe:2.3:o:opensuse:opensuse:13.1:*:*:*:*:*:*:*
cpe:2.3:o:opensuse:opensuse:13.2:*:*:*:*:*:*:*

Configuration 2 (hide)

OR cpe:2.3:a:roundcube:roundcube_webmail:1.1.1:*:*:*:*:*:*:*
cpe:2.3:a:roundcube:roundcube_webmail:1.1.2:*:*:*:*:*:*:*
cpe:2.3:a:roundcube:roundcube_webmail:1.1.3:*:*:*:*:*:*:*
cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*
cpe:2.3:a:roundcube:webmail:1.1:*:*:*:*:*:*:*
cpe:2.3:a:roundcube:webmail:1.1:beta:*:*:*:*:*:*
cpe:2.3:a:roundcube:webmail:1.1:rc:*:*:*:*:*:*
cpe:2.3:a:roundcube:webmail:1.1.4:*:*:*:*:*:*:*

History

21 Nov 2024, 02:39

Type Values Removed Values Added
References () http://lists.opensuse.org/opensuse-updates/2016-08/msg00078.html - Third Party Advisory () http://lists.opensuse.org/opensuse-updates/2016-08/msg00078.html - Third Party Advisory
References () http://lists.opensuse.org/opensuse-updates/2016-08/msg00079.html - Third Party Advisory () http://lists.opensuse.org/opensuse-updates/2016-08/msg00079.html - Third Party Advisory
References () http://lists.opensuse.org/opensuse-updates/2016-08/msg00095.html - Third Party Advisory () http://lists.opensuse.org/opensuse-updates/2016-08/msg00095.html - Third Party Advisory
References () https://github.com/roundcube/roundcubemail/commit/40d7342dd9c9bd2a1d613edc848ed95a4d71aa18 - Patch, Third Party Advisory () https://github.com/roundcube/roundcubemail/commit/40d7342dd9c9bd2a1d613edc848ed95a4d71aa18 - Patch, Third Party Advisory
References () https://github.com/roundcube/roundcubemail/issues/4949 - Third Party Advisory () https://github.com/roundcube/roundcubemail/issues/4949 - Third Party Advisory
References () https://github.com/roundcube/roundcubemail/releases/tag/1.0.9 - Release Notes, Third Party Advisory () https://github.com/roundcube/roundcubemail/releases/tag/1.0.9 - Release Notes, Third Party Advisory
References () https://github.com/roundcube/roundcubemail/releases/tag/1.1.5 - Release Notes, Third Party Advisory () https://github.com/roundcube/roundcubemail/releases/tag/1.1.5 - Release Notes, Third Party Advisory
References () https://github.com/roundcube/roundcubemail/wiki/Changelog#release-115 - Release Notes, Third Party Advisory () https://github.com/roundcube/roundcubemail/wiki/Changelog#release-115 - Release Notes, Third Party Advisory

Information

Published : 2017-04-13 14:59

Updated : 2024-11-21 02:39


NVD link : CVE-2015-8864

Mitre link : CVE-2015-8864

CVE.ORG link : CVE-2015-8864


JSON object : View

Products Affected

roundcube

  • roundcube_webmail
  • webmail

opensuse

  • opensuse
  • leap
CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')