Fluid Attacks Database

Description

program/steps/addressbook/photo.inc in Roundcube Webmail before 1.0.6 and 1.1.x before 1.1.2 allows remote authenticated users to read arbitrary files via the _alt parameter when uploading a vCard.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
debian 11	roundcube	>=0 <1.1.2+dfsg.1-1	1.1.2+dfsg.1-1
debian 12	roundcube	>=0 <1.1.2+dfsg.1-1	1.1.2+dfsg.1-1
debian 13	roundcube	>=0 <1.1.2+dfsg.1-1	1.1.2+dfsg.1-1
debian 14	roundcube	>=0 <1.1.2+dfsg.1-1	1.1.2+dfsg.1-1

Aliases

1. CVE-2015-53822. NVD-2015-53823. OSV-DEBIAN-2015-53824. OSV-2015-53825. SECURITY-TRACKER-CVE-2015-5382

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.