roundcube: CVE-2017-6820: XSS issue in handling of a style tag inside of an svg element

Debian Bug report logs - #857473
roundcube: CVE-2017-6820: XSS issue in handling of a style tag inside of an svg element

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: roundcube: XSS issue in handling of a style tag inside of an svg element

Date: Sat, 11 Mar 2017 20:29:11 +0100

Source: roundcube
Version: 1.2.3+dfsg.1-1
Severity: important
Tags: security patch upstream fixed-upstream

Hi

1.2.4 roundcube release fixed a XSS issue in handling of a style tag
inside of an svg element.

AFAICT, this issue has not yet a CVE assigned, thus I have requested
one. 

Fixed by:

https://github.com/roundcube/roundcubemail/commit/fa2824fdcd44af3f970b2797feb47652482c8305
https://github.com/roundcube/roundcubemail/commit/cbd35626f7db7855f3b5e2db00d28ecc1554e9f4

Upstream changelog:
https://github.com/roundcube/roundcubemail/wiki/Changelog#release-124
https://github.com/roundcube/roundcubemail/releases/tag/1.1.8

Can you make sure the isolated fix (unless 1.2.4 get acked by the
release team), makes it into stretch and ask for an unblock for it?

Regards,
Salvatore

Message #10 received at 857473@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: 857473@bugs.debian.org

Subject: Re: Bug#857473: roundcube: XSS issue in handling of a style tag inside of an svg element

Date: Sun, 12 Mar 2017 17:11:39 +0100

Control: retitle -1 roundcube: CVE-2017-6820: XSS issue in handling of a style tag inside of an svg element

Hi,

On Sat, Mar 11, 2017 at 08:29:11PM +0100, Salvatore Bonaccorso wrote:
> Source: roundcube
> Version: 1.2.3+dfsg.1-1
> Severity: important
> Tags: security patch upstream fixed-upstream
> 
> Hi
> 
> 1.2.4 roundcube release fixed a XSS issue in handling of a style tag
> inside of an svg element.
> 
> AFAICT, this issue has not yet a CVE assigned, thus I have requested
> one. 

This has been assigned CVE-2017-6820.

Regards,
Salvatore

Message #19 received at 857473@bugs.debian.org (full text, mbox, reply):

From: Guilhem Moulin <guilhem@guilhem.org>

To: Salvatore Bonaccorso <carnil@debian.org>, 857473@bugs.debian.org

Subject: Re: [Pkg-roundcube-maintainers] Bug#857473: roundcube: XSS issue in handling of a style tag inside of an svg element

Date: Tue, 14 Mar 2017 04:16:18 +0100

[Message part 1 (text/plain, inline)]

Control: tag -1 pending

Hi,

On Sat, 11 Mar 2017 at 20:29:11 +0100, Salvatore Bonaccorso wrote:
> 1.2.4 roundcube release fixed a XSS issue in handling of a style tag
> inside of an svg element.

Thanks for the ping and the pointers!  I applied the fix to 1.2.3
(unstable) and 1.1.5 (jessie-backports).

Could someone else in the team upload the two source packages?  I don't
have upload privileges :-P  (Also I didn't tag the releases.)

Cheers,
-- 
Guilhem.

[signature.asc (application/pgp-signature, inline)]

Message #26 received at 857473@bugs.debian.org (full text, mbox, reply):

From: Vincent Bernat <bernat@debian.org>

To: Guilhem Moulin <guilhem@guilhem.org>

Cc: Salvatore Bonaccorso <carnil@debian.org>, 857473@bugs.debian.org

Subject: Re: Bug#857473: [Pkg-roundcube-maintainers] Bug#857473: roundcube: XSS issue in handling of a style tag inside of an svg element

Date: Tue, 14 Mar 2017 07:40:34 +0100

[Message part 1 (text/plain, inline)]

 ❦ 14 mars 2017 04:16 +0100, Guilhem Moulin <guilhem@guilhem.org> :

>> 1.2.4 roundcube release fixed a XSS issue in handling of a style tag
>> inside of an svg element.
>
> Thanks for the ping and the pointers!  I applied the fix to 1.2.3
> (unstable) and 1.1.5 (jessie-backports).
>
> Could someone else in the team upload the two source packages?  I don't
> have upload privileges :-P  (Also I didn't tag the releases.)

Both of them uploaded.
-- 
Program defensively.
            - The Elements of Programming Style (Kernighan & Plauger)

[signature.asc (application/pgp-signature, inline)]

Message #31 received at 857473-close@bugs.debian.org (full text, mbox, reply):

From: Guilhem Moulin <guilhem@guilhem.org>

To: 857473-close@bugs.debian.org

Subject: Bug#857473: fixed in roundcube 1.2.3+dfsg.1-2

Date: Tue, 14 Mar 2017 07:03:58 +0000

Source: roundcube
Source-Version: 1.2.3+dfsg.1-2

We believe that the bug you reported is fixed in the latest version of
roundcube, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 857473@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Guilhem Moulin <guilhem@guilhem.org> (supplier of updated roundcube package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Format: 1.8
Date: Tue, 14 Mar 2017 03:41:48 +0100
Source: roundcube
Binary: roundcube-core roundcube roundcube-mysql roundcube-pgsql roundcube-sqlite3 roundcube-plugins
Architecture: source all
Version: 1.2.3+dfsg.1-2
Distribution: unstable
Urgency: high
Maintainer: Debian Roundcube Maintainers <pkg-roundcube-maintainers@lists.alioth.debian.org>
Changed-By: Guilhem Moulin <guilhem@guilhem.org>
Description:
 roundcube  - skinnable AJAX based webmail solution for IMAP servers - metapack
 roundcube-core - skinnable AJAX based webmail solution for IMAP servers
 roundcube-mysql - metapackage providing MySQL dependencies for RoundCube
 roundcube-pgsql - metapackage providing PostgreSQL dependencies for RoundCube
 roundcube-plugins - skinnable AJAX based webmail solution for IMAP servers - plugins
 roundcube-sqlite3 - metapackage providing SQLite dependencies for RoundCube
Closes: 857473
Changes:
 roundcube (1.2.3+dfsg.1-2) unstable; urgency=high
 .
   * Backport fix for CVE-2015-5381: rcube_utils.php in Roundcube before 1.1.8
     and 1.2.x before 1.2.4 is susceptible to a cross-site scripting
     vulnerability via a crafted Cascading Style Sheets (CSS) token sequence
     within an SVG element. (Closes: #857473).
Checksums-Sha1:
 1bee871f0b60162f955d93da88c697451a1b6ba4 2470 roundcube_1.2.3+dfsg.1-2.dsc
 65d0ccfb7e3fb165b2d0a9ea04862d93b74f798b 4441812 roundcube_1.2.3+dfsg.1-2.debian.tar.xz
 0eb9bac287718b3994ffa4534b0bcd01ee0d23ca 2111730 roundcube-core_1.2.3+dfsg.1-2_all.deb
 15d2e7bd458d500a4552d76395e9fc6690463dd1 70588 roundcube-mysql_1.2.3+dfsg.1-2_all.deb
 70f30fadbabcbadec33d6deef0d408c16986b857 70564 roundcube-pgsql_1.2.3+dfsg.1-2_all.deb
 17e337ce79a0a8a53f5e27c276d6fbf90ecb9ec9 661466 roundcube-plugins_1.2.3+dfsg.1-2_all.deb
 f1e7ff6bf917e4d5a98bbf85f9e2dc70297959b6 70542 roundcube-sqlite3_1.2.3+dfsg.1-2_all.deb
 48730e41c121745036041f725c6d3c0b8274cead 1378 roundcube_1.2.3+dfsg.1-2_all.deb
 43545055514470985a0f47db715bdd43c22f71db 8972 roundcube_1.2.3+dfsg.1-2_amd64.buildinfo
Checksums-Sha256:
 47f667061f900e6c49be7bd1e5123eeacc208af58ae72f3ac6e0d938a32bbb5c 2470 roundcube_1.2.3+dfsg.1-2.dsc
 fad1264735ee8c19aef3a702083d93d6d93df0edc257f0520a59f21d9b4aa574 4441812 roundcube_1.2.3+dfsg.1-2.debian.tar.xz
 6c5df9d2dcdf57e9d2e46e1f7818d38ca90f7dc06dea537a3731f9a13499ec12 2111730 roundcube-core_1.2.3+dfsg.1-2_all.deb
 80dac64ae1738512d870d11a4c512c93186a0df60f9f139840eb4b2cb6467432 70588 roundcube-mysql_1.2.3+dfsg.1-2_all.deb
 ccb3ef3e6195fad418d5f21d19bcde1d1254ada188f2455013d4876b3d6a247e 70564 roundcube-pgsql_1.2.3+dfsg.1-2_all.deb
 9c918f570cc7d31a0c46fe17b27222732df6d7b969d35f493008ee0cfa311670 661466 roundcube-plugins_1.2.3+dfsg.1-2_all.deb
 0632904692fe756aa2a110b7a5d01930d28a0f28fdcd5c4cd05783c57f7ec3dd 70542 roundcube-sqlite3_1.2.3+dfsg.1-2_all.deb
 7292b920c52304782696d3f57e9d45850e9a35bea70dd5bb2b922802a3dc7d41 1378 roundcube_1.2.3+dfsg.1-2_all.deb
 7156a6da1ec29a2ba4e3f458f456a1896ca3edc38053441102e66a3a2f56fc8b 8972 roundcube_1.2.3+dfsg.1-2_amd64.buildinfo
Files:
 ac57e5da4bb39084d685664a67c51cd8 2470 web extra roundcube_1.2.3+dfsg.1-2.dsc
 7a7e5eea0e5860d6da607ac702bbb163 4441812 web extra roundcube_1.2.3+dfsg.1-2.debian.tar.xz
 d1b1d45f97346a15dccb6895f544faf8 2111730 web extra roundcube-core_1.2.3+dfsg.1-2_all.deb
 f101523643d18621daa1ef61b380231d 70588 web extra roundcube-mysql_1.2.3+dfsg.1-2_all.deb
 79b14008b0f132168cc0de10a46637a6 70564 web extra roundcube-pgsql_1.2.3+dfsg.1-2_all.deb
 f78ea638046f1e549b6d319a6b04b143 661466 web extra roundcube-plugins_1.2.3+dfsg.1-2_all.deb
 33d5a41229cf15a500f97a02b072e5ff 70542 web extra roundcube-sqlite3_1.2.3+dfsg.1-2_all.deb
 b487531d32323ea049b35bbb4e0aeac7 1378 web extra roundcube_1.2.3+dfsg.1-2_all.deb
 fb6fa15574399d57ec557bc9eb017ca8 8972 web extra roundcube_1.2.3+dfsg.1-2_amd64.buildinfo

-----BEGIN PGP SIGNATURE-----

iQJEBAEBCAAuFiEErvI0h4bzccaJpzYAlaQv6DU1JfkFAljHjwcQHGJlcm5hdEBs
dWZmeS5jeAAKCRCVpC/oNTUl+VZiD/0ey+IElDVGCwTtdfGNTrFNajwJIWpDTy9m
MLJXDPtc7EOu9nilahx9nzp5SS88AwkRkTO9myWNP5B0VLxNRpfZBoWCoDUPJuOC
gwXJEFyWoLK8R8aBErEezZmqm/GP/cMalvgEP5XXaklNZ0ZUdczYPVhiaa4i/Blx
1jZjaGNroJkx4NvfN0LMl9rmtRx1t2d5rkdRv4ONaE2fK+N8/VBUg+D1Tu7CmU0I
KIH3oro0jqP+yMTNTcMJXJHeKIDyRsNa/1wyV4RNSbNRvdR647v9zPV5cXPmbjWW
rxxgIlTc2wre+vgtzWZe3CvOEdavzAa9fsn6eN+3CGeD1dTIs7Q4puY9QsTge/gJ
KvpJV6iY+gs1v3jXs61YykSs95wzXpzXovQ3uknfoXU1o0JPW88md0AvYZC7KiQ7
+hCXpzTGNFvWuHaKP4zETivgseYzwszxhhuNsc+RjJOD+qV/3boUQlpeWsqe3cBP
QJ/LAHElZVeWSJUF69bYjNY+p+dyWFumP0k2unKbC2MAL5YqFNLT5v5sUL/q/BaR
Bg2eJwki3BRIqWBvRNVViSbizjUwn5jhIdf0bZz1zviNJm/e4DFaCSImL/fHletM
GvaT8hZY2z5B/uAUiUvmt92+LAqLKe5yxyODDyJpeYXd7K6ON00kY/YpIt5u3kez
6ipj3K4voQ==
=6l4q
-----END PGP SIGNATURE-----

Message #36 received at 857473@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: Guilhem Moulin <guilhem@guilhem.org>, 857473@bugs.debian.org

Subject: Re: Bug#857473: [Pkg-roundcube-maintainers] Bug#857473: roundcube: XSS issue in handling of a style tag inside of an svg element

Date: Tue, 14 Mar 2017 08:40:04 +0100

Hi

On Tue, Mar 14, 2017 at 04:16:18AM +0100, Guilhem Moulin wrote:
> Control: tag -1 pending
> 
> Hi,
> 
> On Sat, 11 Mar 2017 at 20:29:11 +0100, Salvatore Bonaccorso wrote:
> > 1.2.4 roundcube release fixed a XSS issue in handling of a style tag
> > inside of an svg element.
> 
> Thanks for the ping and the pointers!  I applied the fix to 1.2.3
> (unstable) and 1.1.5 (jessie-backports).

Thanks you Guilhem! (and Vincent as well).

Salvatore

Message #41 received at 857473@bugs.debian.org (full text, mbox, reply):

From: Guilhem Moulin <guilhem@guilhem.org>

To: Vincent Bernat <bernat@debian.org>

Cc: Salvatore Bonaccorso <carnil@debian.org>, 857473@bugs.debian.org

Subject: Re: Bug#857473: [Pkg-roundcube-maintainers] Bug#857473: roundcube: XSS issue in handling of a style tag inside of an svg element

Date: Tue, 14 Mar 2017 12:02:58 +0100

[Message part 1 (text/plain, inline)]

Control: reopen -1
Control: tag -1 pending

On Tue, 14 Mar 2017 at 07:40:34 +0100, Vincent Bernat wrote:
> Both of them uploaded.

Crap, I shouldn't work in the middle of the night, I forgot to add the
patch to the debian/patches/series…  Fixed in the VCS, sorry for the
inconvenience. :-(

-- 
Guilhem.

[signature.asc (application/pgp-signature, inline)]

Message #52 received at 857473-close@bugs.debian.org (full text, mbox, reply):

From: Guilhem Moulin <guilhem@guilhem.org>

To: 857473-close@bugs.debian.org

Subject: Bug#857473: fixed in roundcube 1.2.3+dfsg.1-3

Date: Tue, 14 Mar 2017 12:36:56 +0000

Source: roundcube
Source-Version: 1.2.3+dfsg.1-3

We believe that the bug you reported is fixed in the latest version of
roundcube, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 857473@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Guilhem Moulin <guilhem@guilhem.org> (supplier of updated roundcube package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Format: 1.8
Date: Tue, 14 Mar 2017 11:43:18 +0100
Source: roundcube
Binary: roundcube-core roundcube roundcube-mysql roundcube-pgsql roundcube-sqlite3 roundcube-plugins
Architecture: source all
Version: 1.2.3+dfsg.1-3
Distribution: unstable
Urgency: high
Maintainer: Debian Roundcube Maintainers <pkg-roundcube-maintainers@lists.alioth.debian.org>
Changed-By: Guilhem Moulin <guilhem@guilhem.org>
Description:
 roundcube  - skinnable AJAX based webmail solution for IMAP servers - metapack
 roundcube-core - skinnable AJAX based webmail solution for IMAP servers
 roundcube-mysql - metapackage providing MySQL dependencies for RoundCube
 roundcube-pgsql - metapackage providing PostgreSQL dependencies for RoundCube
 roundcube-plugins - skinnable AJAX based webmail solution for IMAP servers - plugins
 roundcube-sqlite3 - metapackage providing SQLite dependencies for RoundCube
Closes: 857473
Changes:
 roundcube (1.2.3+dfsg.1-3) unstable; urgency=high
 .
   * Backport fix for CVE-2015-5381: rcube_utils.php in Roundcube before 1.1.8
     and 1.2.x before 1.2.4 is susceptible to a cross-site scripting
     vulnerability via a crafted Cascading Style Sheets (CSS) token sequence
     within an SVG element. (Closes: #857473).
     In 1.2.3+dfsg.1-2 the patch wasn't added to debian/patches/series.
Checksums-Sha1:
 6a17fb5886012e6c2479304a285b6abc77db2715 2470 roundcube_1.2.3+dfsg.1-3.dsc
 7bc35f29df51cf94403cec58d3ff42bea9756361 4441880 roundcube_1.2.3+dfsg.1-3.debian.tar.xz
 67d4a79d4ce15bdceefcd4ae0ffb7c554fcbf1a9 2111782 roundcube-core_1.2.3+dfsg.1-3_all.deb
 e8be68927db4660112d32897d34353a725704571 70638 roundcube-mysql_1.2.3+dfsg.1-3_all.deb
 5cc70c57e42867ba3a786523af9fba478fbfa90f 70608 roundcube-pgsql_1.2.3+dfsg.1-3_all.deb
 27b6f89d20aee3cc715803fa15deca3422dc5f98 661502 roundcube-plugins_1.2.3+dfsg.1-3_all.deb
 db47556bb910a673dc03096b66ff34c26d181132 70588 roundcube-sqlite3_1.2.3+dfsg.1-3_all.deb
 0f1ace58250a5c3f011b5f82d92c1574ce2dbeac 1374 roundcube_1.2.3+dfsg.1-3_all.deb
 38a27ce90b0e89e9dd045caeb48332650acf6dbd 8972 roundcube_1.2.3+dfsg.1-3_amd64.buildinfo
Checksums-Sha256:
 8c69da8595b8b2cc27bd3d7f5e87c5f8ec665949cb62f00949c57f29c7af5baa 2470 roundcube_1.2.3+dfsg.1-3.dsc
 1e2c721a117c9f46ee04d71d9121c5020ea94f466f820e2ce3dd95f0f011dda1 4441880 roundcube_1.2.3+dfsg.1-3.debian.tar.xz
 46a0aa15e8f3c9339c333431d94a0ebe29e73afde0ba424fff10a6c191b3f070 2111782 roundcube-core_1.2.3+dfsg.1-3_all.deb
 fd3c2e67eaa6cf9e2a56dbdfd87f3aaf469cc1bb578b3d2bba2f32ee208f5abd 70638 roundcube-mysql_1.2.3+dfsg.1-3_all.deb
 bf1d55aa4d465c0eceb03d0e3166fa83d1ef762deee1b84282eda27d3a603ec1 70608 roundcube-pgsql_1.2.3+dfsg.1-3_all.deb
 dba5e7e4dce8df8233e59885e2008e361388c224a5d9fa6ed7a8ef0bddac5bfa 661502 roundcube-plugins_1.2.3+dfsg.1-3_all.deb
 64eb9166752a5c41278c29f41c5d52e680fc340de7990ef3b8d898b8c0f354ff 70588 roundcube-sqlite3_1.2.3+dfsg.1-3_all.deb
 93d7047c6e215a2d5bd3b1694cd00be50a8f1bb2e2ee8a75158afd51e9b28ae2 1374 roundcube_1.2.3+dfsg.1-3_all.deb
 d16b5c4f18a77b4063537b97b94a20a3dbf1533d03412130425ab82446a83fa0 8972 roundcube_1.2.3+dfsg.1-3_amd64.buildinfo
Files:
 b5ce77900aee1fec5dba88d1f21d63d8 2470 web extra roundcube_1.2.3+dfsg.1-3.dsc
 070adaefcf4754853bf2ecb961f08090 4441880 web extra roundcube_1.2.3+dfsg.1-3.debian.tar.xz
 0cfaff5f4bcbfadfa4512203e19d40a4 2111782 web extra roundcube-core_1.2.3+dfsg.1-3_all.deb
 ed5671fc288459a176d86f82e6b209b1 70638 web extra roundcube-mysql_1.2.3+dfsg.1-3_all.deb
 f605dca57854da39d738a0ec9206c6d3 70608 web extra roundcube-pgsql_1.2.3+dfsg.1-3_all.deb
 cba3988ea6f5b166e4bfff302c0dcc39 661502 web extra roundcube-plugins_1.2.3+dfsg.1-3_all.deb
 7ba6b6e4e9de029382c05be5cd4ab8df 70588 web extra roundcube-sqlite3_1.2.3+dfsg.1-3_all.deb
 6bc265b9d59d4c987a7349bca9029a02 1374 web extra roundcube_1.2.3+dfsg.1-3_all.deb
 ad1814ecba700ab00beb6416d4efeb08 8972 web extra roundcube_1.2.3+dfsg.1-3_amd64.buildinfo

-----BEGIN PGP SIGNATURE-----

iQJEBAEBCAAuFiEErvI0h4bzccaJpzYAlaQv6DU1JfkFAljH3XgQHGJlcm5hdEBs
dWZmeS5jeAAKCRCVpC/oNTUl+d9dD/9u+6X/mgoiUOCH+IyKdFFe3xi35R5VGHsB
1wBFVxWWB6MJRxkiCRVCd8CRFeVM2WAlPW1dVpyX/RvVhlDttHnqEZwc7VGumkd7
zjdcOhZ4ciJaoSAqw7ZLgUQ4S+DhUMg881tQZ1ZYV6qYlyZ7pi1hxKubsPuCF9Cf
aH9ajGKecxMXimydJJdFZVMYg6WrYOzbCGm+VbpH7/hFA+7BqnbjENfGioy/Sy9/
OGzs4+FMZ+pMM/bbOiWOi6FcCQEWx4uXvzZApK3jKqAnA/hDy6Xg1rPhRYsjoe3D
hJTF5AmBmB1ydL1Uf6paPASw8YAmHSt/K1Tt1ev/oLGnjwMiPNL8aeM0qKv1dPrk
JaGmCBsFF1uO8vq7kw2HbRm28BoFDnnsGxUP7GtutJb+SqOXtMklv+eoe3fLkKmR
u8JK95O3j5Uju2FkuhyKC6xniMHhjnvcr2gseoDzUEoVFE7MM+BJ1dHt7/8cHmNu
9znCP7q8zW0tEf7wlEF6Icdomai5BGPyAjJdtjAmcIuFgV75/z0g4La5i/+orD6G
8OK5Sa1051xBQqSuTy7jllu3kKvA9Ea79kGfLSSScxwdZlrHlAcRiuWGOb5v4lQJ
9lv5vLUeqxy/y+pehXmePbMos72U0+mBzt2rEDVHJK3iNlT4F2/euVoFEupnR8rS
IARNVX7j/w==
=IXy3
-----END PGP SIGNATURE-----

Send a report that this bug log contains spam.