Advisories ยป MGASA-2013-0325

Updated roundcubemail package fixes security vulnerability

Publication date: 18 Nov 2013
Type: security
Affected Mageia releases : 2 , 3
CVE: CVE-2013-6172

Description

It was discovered that roundcube does not properly sanitize the
_session parameter in steps/utils/save_pref.inc during saving
preferences. The vulnerability can be exploited to overwrite
configuration settings and subsequently allowing random file access,
manipulated SQL queries and even code execution (CVE-2013-6172).
                

References

SRPMS

3/core

2/core