| Name | CVE-2017-16651 |
| Description | Roundcube Webmail before 1.1.10, 1.2.x before 1.2.7, and 1.3.x before 1.3.3 allows unauthorized access to arbitrary files on the host's filesystem, including configuration files, as exploited in the wild in November 2017. The attacker must be able to authenticate at the target system with a valid username/password as the attack requires an active session. The issue is related to file-based attachment plugins and _task=settings&_action=upload-display&_from=timezone requests. |
| Source | CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more) |
| References | DLA-1193-1, DSA-4030-1 |
The table below lists information on source packages.
| Source Package | Release | Version | Status |
|---|---|---|---|
| roundcube (PTS) | bullseye (security), bullseye | 1.4.15+dfsg.1-1+deb11u4 | fixed |
| bookworm, bookworm (security) | 1.6.5+dfsg-1+deb12u4 | fixed | |
| sid, trixie | 1.6.9+dfsg-2 | fixed |
The information below is based on the following data on fixed versions.
| Package | Type | Release | Fixed Version | Urgency | Origin | Debian Bugs |
|---|---|---|---|---|---|---|
| roundcube | source | wheezy | 0.7.2-9+deb7u9 | DLA-1193-1 | ||
| roundcube | source | stretch | 1.2.3+dfsg.1-4+deb9u1 | DSA-4030-1 | ||
| roundcube | source | (unstable) | 1.3.3+dfsg.1-1 |
master: https://github.com/roundcube/roundcubemail/commit/2a32f51c91d5e9c7b1a9d931846dd44c008ff36d
release-1.3: https://github.com/roundcube/roundcubemail/commit/c90ad5a97784fb32683b8e3c21d6c95baab6d806
release-1.2: https://github.com/roundcube/roundcubemail/commit/9be2224c779d7abc7b29eea2b83a8a3671c543e0
release-1.1: https://github.com/roundcube/roundcubemail/commit/e757cc410145d043c30889d28fa0b5f67a5cf2fd
release-1.0: https://github.com/roundcube/roundcubemail/commit/8d87bb34f3c6103ab81e5342d8b3d297832d178a
https://github.com/roundcube/roundcubemail/issues/6026