Описание
Security update for roundcubemail
This update to roundcubemail 1.1.4 fixes the following issues:
- CVE-2015-8770: Path traversal vulnerability allowed code execution to remote authenticated users if they were also upload files to the same server through some other method (boo#962067)
This update also contains all upstream fixes in 1.1.4. The package was updated to use generic PHP requirements for use with other prefixes than 'php5-'
Список пакетов
openSUSE Leap 42.1
roundcubemail-1.1.4-6.1
Ссылки
- E-Mail link for openSUSE-SU-2016:0213-1
- SUSE Security Ratings
Описание
Directory traversal vulnerability in the set_skin function in program/include/rcmail_output_html.php in Roundcube before 1.0.8 and 1.1.x before 1.1.4 allows remote authenticated users with certain permissions to read arbitrary files or possibly execute arbitrary code via a .. (dot dot) in the _skin parameter to index.php.
Затронутые продукты
openSUSE Leap 42.1:roundcubemail-1.1.4-6.1
Ссылки
- CVE-2015-8770
- SUSE Bug 962067