Security Information / 2017 / Security Information -- DSA-4030-1 roundcube

Debian Security Advisory

DSA-4030-1 roundcube -- security update

Date Reported:

09 Nov 2017

Affected Packages:

roundcube

Vulnerable:

Yes

Security database references:

In Mitre's CVE dictionary: CVE-2017-16651.

More information:

A file disclosure vulnerability was discovered in roundcube, a skinnable AJAX based webmail solution for IMAP servers. An authenticated attacker can take advantage of this flaw to read roundcube's configuration files.

For the stable distribution (stretch), this problem has been fixed in version 1.2.3+dfsg.1-4+deb9u1.

For the unstable distribution (sid), this problem has been fixed in version 1.3.3+dfsg.1-1.

We recommend that you upgrade your roundcube packages.