Security
Security
A vulnerability in RoundCube may allow authenticated users to bypass security restrictions.
| Package | mail-client/roundcube on all architectures |
|---|---|
| Affected versions | < 1.2.5 |
| Unaffected versions | >= 1.2.5 |
Free and open source webmail software for the masses, written in PHP.
Authenticated users can arbitrarily reset passwords due to a problem caused by an improperly restricted exec call in the virtualmin and sasl drivers of the password plugin.
Authenticated users can bypass security restrictions and elevate privileges.
There is no known workaround at this time.
All RoundCube users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=mail-client/roundcube-1.2.5"
Release date
July 08, 2017
Latest revision
July 08, 2017: 1
Severity
normal
Exploitable
remote
Bugzilla entries