Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.1
CVE-2015-8864: Roundcube Webmail: Injecting Malicious Code via SVG
CVE-2015-8864 · published 9 years ago
Summary
An attacker can inject malicious code into Roundcube Webmail, potentially allowing them to steal sensitive information or take control of user sessions. This issue affects users of Roundcube Webmail versions 1.0.8 and earlier, as well as versions 1.1.x up to and including 1.1.4. To protect your users, update to Roundcube Webmail version 1.0.9 or later, or version 1.1.5 or later.
What to do
- Update debian roundcube to version 1.1.5+dfsg.1-1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Debian:11 | debian | roundcube |
< 1.1.5+dfsg.1-1 Fix: upgrade to 1.1.5+dfsg.1-1
|
| Debian:12 | debian | roundcube |
< 1.1.5+dfsg.1-1 Fix: upgrade to 1.1.5+dfsg.1-1
|
| Debian:13 | debian | roundcube |
< 1.1.5+dfsg.1-1 Fix: upgrade to 1.1.5+dfsg.1-1
|
| Debian:14 | debian | roundcube |
< 1.1.5+dfsg.1-1 Fix: upgrade to 1.1.5+dfsg.1-1
|
| – | opensuse | leap |
42.1 cpe:2.3:o:opensuse:leap:42.1:*:*:*:*:*:*:* |
| – | opensuse | opensuse |
13.1 13.2 cpe:2.3:o:opensuse:opensuse:13.1:*:*:*:*:*:*:* |
| – | roundcube | roundcube_webmail |
1.1.1 1.1.2 1.1.3 cpe:2.3:a:roundcube:roundcube_webmail:1.1.1:*:*:*:*:*:*:* |
| – | roundcube | webmail |
<= 1.0.8 1.1 1.1.4 cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:* |
Original advisory text
Cross-site scripting (XSS) vulnerability in Roundcube Webmail before 1.0.9 and 1.1.x before 1.1.5 allows remote attackers to inject arbitrary web script or HTML via a crafted SVG, a different vulne...
Cross-site scripting (XSS) vulnerability in Roundcube Webmail before 1.0.9 and 1.1.x before 1.1.5 allows remote attackers to inject arbitrary web script or HTML via a crafted SVG, a different vulnerability than CVE-2016-4068.
References
- https://security-tracker.debian.org/tracker/CVE-2015-8864 Vendor Advisory
- http://lists.opensuse.org/opensuse-updates/2016-08/msg00078.html Third Party Advisory
- http://lists.opensuse.org/opensuse-updates/2016-08/msg00079.html Third Party Advisory
- http://lists.opensuse.org/opensuse-updates/2016-08/msg00095.html Third Party Advisory
- https://github.com/roundcube/roundcubemail/commit/40d7342dd9c9bd2a1d613edc848ed9... Patch Third Party Advisory
- https://github.com/roundcube/roundcubemail/issues/4949 Third Party Advisory
- https://github.com/roundcube/roundcubemail/releases/tag/1.0.9 Release Notes Third Party Advisory
- https://github.com/roundcube/roundcubemail/releases/tag/1.1.5 Release Notes Third Party Advisory
- https://github.com/roundcube/roundcubemail/wiki/Changelog#release-115 Release Notes Third Party Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker partial control (estimated)
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published13 Apr 2017
Updated30 Oct 2026
First seen29 May 2026
Track software like this
Free during beta