CVE-2014-9587

NameCVE-2014-9587
DescriptionMultiple cross-site request forgery (CSRF) vulnerabilities in Roundcube Webmail before 1.0.4 allow remote attackers to hijack the authentication of unspecified victims via unknown vectors, related to (1) address book operations or the (2) ACL or (3) Managesieve plugins.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
ReferencesDLA-613-1
NVD severitymedium
Debian Bugs775576

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
roundcube (PTS)stretch1.2.3+dfsg.1-4+deb9u6fixed
stretch (security)1.2.3+dfsg.1-4+deb9u8fixed
buster, buster (security)1.3.16+dfsg.1-1~deb10u1fixed
bullseye, sid1.4.11+dfsg.1-3fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
roundcubesourcewheezy0.7.2-9+deb7u4DLA-613-1
roundcubesource(unstable)1.1.1+dfsg.1-2775576

Notes

[squeeze] - roundcube <no-dsa> (Minor issue)
[wheezy] - roundcube <no-dsa> (Minor issue)
https://github.com/roundcube/roundcubemail/commit/376cbfd4f2dfcf455717409b70d9d056cbeb08b1
Search for package or bug name: Reporting problems