CVE-2024-37383
Publication date 7 June 2024
Last updated 24 July 2024
Ubuntu priority
Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 allows XSS via SVG animate attributes.
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| roundcube | 24.04 LTS noble |
Not affected
|
| 22.04 LTS jammy |
Fixed 1.5.0+dfsg.1-2ubuntu0.1~esm3
|
|
| 20.04 LTS focal |
Fixed 1.4.3+dfsg.1-1ubuntu0.1~esm4
|
|
| 18.04 LTS bionic |
Fixed 1.3.6+dfsg.1-1ubuntu0.1~esm4
|
|
| 16.04 LTS xenial |
Not affected
|
Get expanded security coverage with Ubuntu Pro
Reduce your average CVE exposure time from 98 days to 1 day with expanded CVE patching, ten-years security maintenance and optional support for the full stack of open-source applications. Free for personal use.
Get Ubuntu ProReferences
Related Ubuntu Security Notices (USN)
- USN-6848-1
- Roundcube vulnerabilities
- 25 June 2024
Other references
- https://www.cve.org/CVERecord?id=CVE-2024-37383
- https://github.com/roundcube/roundcubemail/commit/ba252dc5e2946506cb8d0b50b2b7bf95ab51876f
- https://github.com/roundcube/roundcubemail/commit/43aaaa528646877789ec028d87924ba1accf5242
- https://github.com/roundcube/roundcubemail/releases/tag/1.6.7
- https://github.com/roundcube/roundcubemail/releases/tag/1.5.7