Candidate: CVE-2017-16651
PublicDate: 2017-11-09 14:29:00 UTC
References:
 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-16651
 https://github.com/roundcube/roundcubemail/issues/6026
 https://github.com/roundcube/roundcubemail/releases/tag/1.1.10
 https://github.com/roundcube/roundcubemail/releases/tag/1.2.7
 https://github.com/roundcube/roundcubemail/releases/tag/1.3.3
 https://roundcube.net/news/2017/11/08/security-updates-1.3.3-1.2.7-and-1.1.10
Description:
 Roundcube Webmail before 1.1.10, 1.2.x before 1.2.7, and 1.3.x before 1.3.3
 allows unauthorized access to arbitrary files on the host's filesystem,
 including configuration files, as exploited in the wild in November 2017.
 The attacker must be able to authenticate at the target system with a valid
 username/password as the attack requires an active session. The issue is
 related to file-based attachment plugins and
 _task=settings&_action=upload-display&_from=timezone requests.
Ubuntu-Description:
Notes:
Bugs:
Priority: medium
Discovered-by:
Assigned-to:
CVSS:
 nvd: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H [7.8 HIGH]
 nvd: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H [7.8 HIGH]

Patches_roundcube:
 upstream: https://github.com/roundcube/roundcubemail/commit/2a32f51c91d5e9c7b1a9d931846dd44c008ff36d
 upstream: https://github.com/roundcube/roundcubemail/commit/c90ad5a97784fb32683b8e3c21d6c95baab6d806 (release-1.3)
 upstream: https://github.com/roundcube/roundcubemail/commit/9be2224c779d7abc7b29eea2b83a8a3671c543e0 (release-1.2)
upstream_roundcube: released (1.3.3+dfsg.1-1)
precise/esm_roundcube: DNE
trusty_roundcube: ignored (reached end-of-life)
trusty/esm_roundcube: DNE (trusty was needed)
xenial_roundcube: ignored (end of standard support, was needed)
zesty_roundcube: ignored (reached end-of-life)
artful_roundcube: ignored (reached end-of-life)
bionic_roundcube: not-affected (1.3.6+dfsg.1-1)
cosmic_roundcube: not-affected (1.3.6+dfsg.1-1)
disco_roundcube: not-affected (1.3.6+dfsg.1-1)
eoan_roundcube: not-affected (1.3.6+dfsg.1-1)
focal_roundcube: not-affected (1.3.6+dfsg.1-1)
groovy_roundcube: not-affected (1.3.6+dfsg.1-1)
hirsute_roundcube: not-affected (1.3.6+dfsg.1-1)
impish_roundcube: not-affected (1.3.6+dfsg.1-1)
jammy_roundcube: not-affected (1.3.6+dfsg.1-1)
devel_roundcube: not-affected (1.3.6+dfsg.1-1)