advisories/20463.adv

type: security
subject: Updated roundcubemail package fixes security vulnerability
CVE:
 - CVE-2017-6820
src:
  5:
   core:
     - roundcubemail-1.0.9-1.2.mga5
description: |
  rcube_utils.php in Roundcube before 1.1.8 and before 1.2.4 is
  susceptible to a cross-site scripting vulnerability via a crafted
  Cascading Style Sheets (CSS) token sequence within an SVG element
  (CVE-2017-6820).
references:
 - https://bugs.mageia.org/show_bug.cgi?id=20463
 - http://openwall.com/lists/oss-security/2017/03/12/2
ID: MGASA-2017-0092
1	type: security
2	subject: Updated roundcubemail package fixes security vulnerability
3	CVE:
4	- CVE-2017-6820
5	src:
6	5:
7	core:
8	- roundcubemail-1.0.9-1.2.mga5
9	description: \|
10	rcube_utils.php in Roundcube before 1.1.8 and before 1.2.4 is
11	susceptible to a cross-site scripting vulnerability via a crafted
12	Cascading Style Sheets (CSS) token sequence within an SVG element
13	(CVE-2017-6820).
14	references:
15	- https://bugs.mageia.org/show_bug.cgi?id=20463
16	- http://openwall.com/lists/oss-security/2017/03/12/2
17	ID: MGASA-2017-0092