MGASA-2023-0332

See a problem?
Please try reporting it to the source first.

Source

https://advisories.mageia.org/MGASA-2023-0332.html

Import Source

https://advisories.mageia.org/MGASA-2023-0332.json

JSON Data

https://api.test.osv.dev/v1/vulns/MGASA-2023-0332

Upstream

Published

2023-12-01T11:54:47Z

Modified

2026-04-16T00:12:39Z

Summary

Updated roundcubemail packages fix XSS security vulnerabilities

Details

Updated roundcubemail package fixes security vulnerabilities:

Fix cross-site scripting (XSS) vulnerability in setting Content-Type/ Content-Disposition for attachment preview/download (CVE-2023-47272)

Fix cross-site scripting (XSS) vulnerability in handling of SVG in HTML messages. (CVE-2023-5631)

Some other errors have been fixed:

Fix PHP8 fatal error when parsing a malformed BODYSTRUCTURE
Fix duplicated Inbox folder on IMAP servers that do not use Inbox folder with all capital letters
Fix PHP warnings
Fix UI issue when dealing with an invalid managesieve_default_headers value
Fix bug where images attached to application/smil messages weren't displayed
Fix PHP string replacement error in utils/error.php
Fix regression where smtp_user did not allow pre/post strings before/after %u placeholder

References

Credits

Affected packages

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

1.6.5-1.mga9

{
    "section": "core"
}

source

"https://advisories.mageia.org/MGASA-2023-0332.json"