drucken bookmarks versenden konfigurieren admin pdf Sicherheit: Mehrere Probleme in roundcubemail
Name: |
Mehrere Probleme in roundcubemail |
|
ID: |
FEDORA-2013-16192 |
|
Distribution: |
Fedora |
|
Plattformen: |
Fedora 18 |
|
Datum: |
Mi, 18. September 2013, 18:39 |
|
Referenzen: |
http://trac.roundcube.net/wiki/Changelog#RELEASE0.9.3 |
|
Applikationen: |
RoundCube Webmail |
|
Originalnachricht |
Name : roundcubemail Product : Fedora 18 Version : 0.9.4 Release : 1.fc18 URL : http://www.roundcube.net Summary : Round Cube Webmail is a browser-based multilingual IMAP client Description : RoundCube Webmail is a browser-based multilingual IMAP client with an application-like user interface. It provides full functionality you expect from an e-mail client, including MIME support, address book, folder manipulation, message searching and spell checking. RoundCube Webmail is written in PHP and requires a database: MySQL, PostgreSQL and SQLite are known to work. The user interface is fully skinnable using XHTML and CSS 2.
------------------------------------------------------------------------------- - Update Information:
0.9.4, latest upstream.
Require webserver rather than httpd. Two XSS flaws were fixed in roundcube 0.9.3 [1]:
* Fix XSS vulnerability when saving HTML signatures [2],[3]
* Fix XSS vulnerability when editing a message "as new" or draft [2],[4]
[1] http://trac.roundcube.net/wiki/Changelog#RELEASE0.9.3
[2] http://trac.roundcube.net/ticket/1489251
[3] github [4] github ------------------------------------------------------------------------------- - ChangeLog:
* Mon Sep 9 2013 Jon Ciesla <limburgher@gmail.com> - 0.9.4-1 - 0.9.4 - Change httpd dep to webserver, BZ 1005696. * Fri Aug 23 2013 Adam Williamson <awilliam@redhat.com> - 0.9.3-2 - patch tinymce to cope elegantly with Flash binary being removed * Fri Aug 23 2013 Jon Ciesla <limburgher@gmail.com> - 0.9.3-1 - Fix two XSS vulnerabilities: - http://trac.roundcube.net/ticket/1489251 * Fri Aug 16 2013 Jon Ciesla <limburgher@gmail.com> - 0.9.2-3 - Drop precompiled flash. * Sun Aug 4 2013 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 0.9.2-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_20_Mass_Rebuild * Mon Jun 17 2013 Adam Williamson <awilliam@redhat.com> - 0.9.2-1 - latest upstream - correct License field, add comment on complex licensing case * Wed May 1 2013 Adam Williamson <awilliam@redhat.com> - 0.9.0-1 - latest upstream - drop MDB2 dependencies, add php-pdo dependency (upstream now using pdo not MDB2) - drop the update.sh script as it requires the installer framework we don't ship - update the Fedora README for changes to sqlite and update process - drop strict.patch, upstream actually merged it years ago, just in a slightly different format, and we kept dumbly diffing it - drop references to obsolete patches (all merged upstream long ago) * Thu Mar 28 2013 Jon Ciesla <limburgher@gmail.com> - 0.8.6-1 - Latest upstream, fixes local file inclusion via web UI - modification of certain config options. * Fri Feb 8 2013 Jon Ciesla <limburgher@gmail.com> - 0.8.5-1 - Latest upstream, CVE-2012-6121. * Mon Dec 3 2012 Remi Collet <remi@fedoraproject.org> - 0.8.4-2 - requires php-fileinfo instead of php-pecl-Fileinfo ------------------------------------------------------------------------------- - References:
[ 1 ] Bug #1005696 - roundcubemail depends on httpd (apache) https://bugzilla.redhat.com/show_bug.cgi?id=1005696 [ 2 ] Bug #1000511 - roundcubemail: two XSS flaws fixed in 0.9.3 [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1000511 [ 3 ] Bug #1000512 - roundcubemail: two XSS flaws fixed in 0.9.3 [epel-6] https://bugzilla.redhat.com/show_bug.cgi?id=1000512 ------------------------------------------------------------------------------- -
This update can be installed with the "yum" update program. Use su -c 'yum update roundcubemail' at the command line. For more information, refer to "Managing Software with yum", available at http://docs.fedoraproject.org/yum/.
All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/keys ------------------------------------------------------------------------------- - _______________________________________________ package-announce mailing list package-announce@lists.fedoraproject.org https://admin.fedoraproject.org/mailman/listinfo/package-announce
|
|
|
|