CVE-2014-9587

NameCVE-2014-9587
DescriptionMultiple cross-site request forgery (CSRF) vulnerabilities in Roundcube Webmail before 1.0.4 allow remote attackers to hijack the authentication of unspecified victims via unknown vectors, related to (1) address book operations or the (2) ACL or (3) Managesieve plugins.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDLA-613-1
Debian Bugs775576

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
roundcube (PTS)stretch (security), stretch (lts), stretch1.2.3+dfsg.1-4+deb9u10fixed
buster, buster (lts)1.3.17+dfsg.1-1~deb10u7fixed
buster (security)1.3.17+dfsg.1-1~deb10u6fixed
bullseye (security), bullseye1.4.15+dfsg.1-1+deb11u4fixed
bookworm (security), bookworm1.6.5+dfsg-1+deb12u4fixed
sid, trixie1.6.9+dfsg-2fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
roundcubesourcewheezy0.7.2-9+deb7u4DLA-613-1
roundcubesource(unstable)1.1.1+dfsg.1-2775576

Notes

[squeeze] - roundcube <no-dsa> (Minor issue)
[wheezy] - roundcube <no-dsa> (Minor issue)
https://github.com/roundcube/roundcubemail/commit/376cbfd4f2dfcf455717409b70d9d056cbeb08b1

Search for package or bug name: Reporting problems