Candidate: CVE-2015-8864
PublicDate: 2017-04-13 14:59:00 UTC
References:
 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8864
 https://github.com/roundcube/roundcubemail/issues/4949
 https://github.com/roundcube/roundcubemail/wiki/Changelog#release-115
 https://github.com/roundcube/roundcubemail/commit/40d7342dd9c9bd2a1d613edc848ed95a4d71aa18
 https://github.com/roundcube/roundcubemail/commit/7bbefdb63b12e2344cf1cb87aeb6e3933b4063e0 (release-1.1)
 http://www.openwall.com/lists/oss-security/2016/04/23/3
Description:
 Cross-site scripting (XSS) vulnerability in Roundcube Webmail before 1.0.9
 and 1.1.x before 1.1.5 allows remote attackers to inject arbitrary web
 script or HTML via a crafted SVG, a different vulnerability than
 CVE-2016-4068.
Ubuntu-Description:
Notes:
Bugs:
 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=822333
Priority: medium
Discovered-by:
Assigned-to:
CVSS:
 nvd: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N [6.1 MEDIUM]

Patches_roundcube:
upstream_roundcube: released (1.0.9, 1.1.5)
precise_roundcube: ignored (reached end-of-life)
precise/esm_roundcube: DNE (precise was needed)
trusty_roundcube: ignored (reached end-of-life)
trusty/esm_roundcube: DNE (trusty was needed)
vivid/stable-phone-overlay_roundcube: DNE
vivid/ubuntu-core_roundcube: DNE
wily_roundcube: ignored (reached end-of-life)
xenial_roundcube: not-affected (1.2~beta+dfsg.1-0ubuntu1)
yakkety_roundcube: ignored (reached end-of-life)
zesty_roundcube: ignored (reached end-of-life)
artful_roundcube: ignored (reached end-of-life)
bionic_roundcube: not-affected (1.3.6+dfsg.1-1)
cosmic_roundcube: not-affected (1.3.6+dfsg.1-1)
disco_roundcube: not-affected (1.3.6+dfsg.1-1)
devel_roundcube: not-affected (1.3.6+dfsg.1-1)