Описание
rcube_image.php in Roundcube Webmail before 1.4.4 allows attackers to execute arbitrary code via shell metacharacters in a configuration setting for im_convert_path or im_identify_path.
Пакеты
| Пакет | Статус | Версия исправления | Релиз | Тип |
|---|---|---|---|---|
| roundcube | fixed | 1.4.4+dfsg.1-1 | package | |
| roundcube | fixed | 1.3.11+dfsg.1-1~deb10u1 | buster | package |
Примечания
https://github.com/roundcube/roundcubemail/commit/fcfb099477f353373c34c8a65c9035b06b364db3
https://roundcube.net/news/2020/04/29/security-updates-1.4.4-1.3.11-and-1.2.10
EPSS
Связанные уязвимости
rcube_image.php in Roundcube Webmail before 1.4.4 allows attackers to execute arbitrary code via shell metacharacters in a configuration setting for im_convert_path or im_identify_path.
rcube_image.php in Roundcube Webmail before 1.4.4 allows attackers to execute arbitrary code via shell metacharacters in a configuration setting for im_convert_path or im_identify_path.
rcube_image.php in Roundcube Webmail before 1.4.4 allows attackers to execute arbitrary code via shell metacharacters in a configuration setting for im_convert_path or im_identify_path.
Уязвимость функций im_convert_path и im_identify_path файла rcube_image.php почтового клиента RoundCube Webmail, позволяющая нарушителю выполнить произвольный код
EPSS