CVE-2024-37384
Publication date 7 June 2024
Last updated 24 July 2024
Ubuntu priority
Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 allows XSS via list columns from user preferences.
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| roundcube | 24.04 LTS noble |
Not affected
|
| 22.04 LTS jammy |
Fixed 1.5.0+dfsg.1-2ubuntu0.1~esm3
|
|
| 20.04 LTS focal |
Fixed 1.4.3+dfsg.1-1ubuntu0.1~esm4
|
|
| 18.04 LTS bionic |
Fixed 1.3.6+dfsg.1-1ubuntu0.1~esm4
|
|
| 16.04 LTS xenial |
Fixed 1.2~beta+dfsg.1-0ubuntu1+esm4
|
Get expanded security coverage with Ubuntu Pro
Reduce your average CVE exposure time from 98 days to 1 day with expanded CVE patching, ten-years security maintenance and optional support for the full stack of open-source applications. Free for personal use.
Get Ubuntu ProReferences
Related Ubuntu Security Notices (USN)
- USN-6848-1
- Roundcube vulnerabilities
- 25 June 2024
Other references
- https://www.cve.org/CVERecord?id=CVE-2024-37384
- https://github.com/roundcube/roundcubemail/commit/9ca8aa6680c579132e0d1fa59447df8d524ec91c
- https://github.com/roundcube/roundcubemail/releases/tag/1.6.7
- https://github.com/roundcube/roundcubemail/releases/tag/1.5.7
- https://github.com/roundcube/roundcubemail/commit/cde4522c5c95f13c6aeeb1600ab17e5067a536f7