Roundcube 1.5.x before 1.5.6 and 1.6.x before 1.6.5 allows XSS via a Content-Type or Content-Disposition header (used for attachment preview or download).
{ "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro", "binaries": [ { "binary_name": "roundcube", "binary_version": "1.4.3+dfsg.1-1ubuntu0.1~esm4" }, { "binary_name": "roundcube-core", "binary_version": "1.4.3+dfsg.1-1ubuntu0.1~esm4" }, { "binary_name": "roundcube-mysql", "binary_version": "1.4.3+dfsg.1-1ubuntu0.1~esm4" }, { "binary_name": "roundcube-pgsql", "binary_version": "1.4.3+dfsg.1-1ubuntu0.1~esm4" }, { "binary_name": "roundcube-plugins", "binary_version": "1.4.3+dfsg.1-1ubuntu0.1~esm4" }, { "binary_name": "roundcube-sqlite3", "binary_version": "1.4.3+dfsg.1-1ubuntu0.1~esm4" } ] }
{ "binaries": [ { "binary_name": "roundcube", "binary_version": "1.5.0+dfsg.1-2" }, { "binary_name": "roundcube-core", "binary_version": "1.5.0+dfsg.1-2" }, { "binary_name": "roundcube-mysql", "binary_version": "1.5.0+dfsg.1-2" }, { "binary_name": "roundcube-pgsql", "binary_version": "1.5.0+dfsg.1-2" }, { "binary_name": "roundcube-plugins", "binary_version": "1.5.0+dfsg.1-2" }, { "binary_name": "roundcube-sqlite3", "binary_version": "1.5.0+dfsg.1-2" } ] }
{ "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro", "binaries": [ { "binary_name": "roundcube", "binary_version": "1.5.0+dfsg.1-2ubuntu0.1~esm3" }, { "binary_name": "roundcube-core", "binary_version": "1.5.0+dfsg.1-2ubuntu0.1~esm3" }, { "binary_name": "roundcube-mysql", "binary_version": "1.5.0+dfsg.1-2ubuntu0.1~esm3" }, { "binary_name": "roundcube-pgsql", "binary_version": "1.5.0+dfsg.1-2ubuntu0.1~esm3" }, { "binary_name": "roundcube-plugins", "binary_version": "1.5.0+dfsg.1-2ubuntu0.1~esm3" }, { "binary_name": "roundcube-sqlite3", "binary_version": "1.5.0+dfsg.1-2ubuntu0.1~esm3" } ] }