Public via oss-security:

Date: Wed, 28 Aug 2013 12:59:43 -0400 (EDT)
From: cve-assign@mitre...
Subject: [oss-security] Re: CVE request: roundcube 0.9.3 fixes two XSS flaws


Note: roundcubemail exists only for openSUSE!


>[2] http://trac.roundcube.net/ticket/1489251

The first CVE assignment for this is CVE-2013-5645. The scope of this
CVE includes:

  http://trac.roundcube.net/changeset/93b0a30c1c8aa29d862b587b31e52bcc344b8d16/github

  Fix XSS vulnerability when editing a message "as new" or draft

  "rcmail_wash_html($body, array('safe' => 1), $cid_map);"
  added in compose.inc

The scope of this CVE also includes:

  http://trac.roundcube.net/changeset/ce5a6496fd6039962ba7424d153278e41ae8761b/github

  Fix XSS vulnerability when saving HTML signatures

  "rcmail_wash_html($save_data['signature']);"
  added in save_identity.inc

to the extent that this can cross privilege boundaries within the
Roundcube webmail product.

All aspects of CVE-2013-5645 were discovered by und3r. These are all
CVE-2013-5645 references:

  http://trac.roundcube.net/wiki/Changelog#RELEASE0.9.3
  http://trac.roundcube.net/ticket/1489251
  http://trac.roundcube.net/changeset/ce5a6496fd6039962ba7424d153278e41ae8761b/github
  http://trac.roundcube.net/changeset/93b0a30c1c8aa29d862b587b31e52bcc344b8d16/github


The scope of CVE-2013-5645 does not include any additional
exploitation approaches (if any) in Roundcube webmail, or other
products, that are related to:

  'This kind of problem is present in all parts where there is
  the "MCE" editor (or, more specifically, where there is a
  <textarea> with the CSS class "mce_editor").'

That may possibly have other CVE assignments if someone investigates
it at a later time.

-------------------

Additional note:
CVE-2013-5646 (addressbook group vulnerability) affects only version 1.0-git (not version 0.9.2).