From owner-freebsd-ports-bugs@FreeBSD.ORG  Sun Jan 25 04:00:03 2009
Return-Path: <owner-freebsd-ports-bugs@FreeBSD.ORG>
Delivered-To: freebsd-ports-bugs@hub.freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34])
	by hub.freebsd.org (Postfix) with ESMTP id E53C81065687
	for <freebsd-ports-bugs@hub.freebsd.org>;
	Sun, 25 Jan 2009 04:00:03 +0000 (UTC)
	(envelope-from gnats@FreeBSD.org)
Received: from freefall.freebsd.org (freefall.freebsd.org
	[IPv6:2001:4f8:fff6::28])
	by mx1.freebsd.org (Postfix) with ESMTP id 9D98E8FC21
	for <freebsd-ports-bugs@hub.freebsd.org>;
	Sun, 25 Jan 2009 04:00:03 +0000 (UTC)
	(envelope-from gnats@FreeBSD.org)
Received: from freefall.freebsd.org (gnats@localhost [127.0.0.1])
	by freefall.freebsd.org (8.14.3/8.14.3) with ESMTP id n0P403l2044876
	for <freebsd-ports-bugs@freefall.freebsd.org>;
	Sun, 25 Jan 2009 04:00:03 GMT
	(envelope-from gnats@freefall.freebsd.org)
Received: (from gnats@localhost)
	by freefall.freebsd.org (8.14.3/8.14.3/Submit) id n0P403Ak044875;
	Sun, 25 Jan 2009 04:00:03 GMT (envelope-from gnats)
Resent-Date: Sun, 25 Jan 2009 04:00:03 GMT
Resent-Message-Id: <200901250400.n0P403Ak044875@freefall.freebsd.org>
Resent-From: FreeBSD-gnats-submit@FreeBSD.org (GNATS Filer)
Resent-To: freebsd-ports-bugs@FreeBSD.org
Resent-Reply-To: FreeBSD-gnats-submit@FreeBSD.org, Mark Foster <mark@foster.cc>
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34])
	by hub.freebsd.org (Postfix) with ESMTP id 748AF106566C
	for <freebsd-gnats-submit@FreeBSD.org>;
	Sun, 25 Jan 2009 03:56:41 +0000 (UTC)
	(envelope-from nobody@FreeBSD.org)
Received: from www.freebsd.org (www.freebsd.org [IPv6:2001:4f8:fff6::21])
	by mx1.freebsd.org (Postfix) with ESMTP id 62F7B8FC18
	for <freebsd-gnats-submit@FreeBSD.org>;
	Sun, 25 Jan 2009 03:56:41 +0000 (UTC)
	(envelope-from nobody@FreeBSD.org)
Received: from www.freebsd.org (localhost [127.0.0.1])
	by www.freebsd.org (8.14.3/8.14.3) with ESMTP id n0P3udlm042981
	for <freebsd-gnats-submit@FreeBSD.org>; Sun, 25 Jan 2009 03:56:39 GMT
	(envelope-from nobody@www.freebsd.org)
Received: (from nobody@localhost)
	by www.freebsd.org (8.14.3/8.14.3/Submit) id n0P3udFL042980;
	Sun, 25 Jan 2009 03:56:39 GMT (envelope-from nobody)
Message-Id: <200901250356.n0P3udFL042980@www.freebsd.org>
Date: Sun, 25 Jan 2009 03:56:39 GMT
From: Mark Foster <mark@foster.cc>
To: freebsd-gnats-submit@FreeBSD.org
X-Send-Pr-Version: www-3.1
Cc: 
Subject: ports/130968: [vuxml] mail/roundcube vulnerability
X-BeenThere: freebsd-ports-bugs@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: Ports bug reports <freebsd-ports-bugs.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-ports-bugs>, 
	<mailto:freebsd-ports-bugs-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-ports-bugs>
List-Post: <mailto:freebsd-ports-bugs@freebsd.org>
List-Help: <mailto:freebsd-ports-bugs-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-ports-bugs>, 
	<mailto:freebsd-ports-bugs-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Sun, 25 Jan 2009 04:00:06 -0000


>Number:         130968
>Category:       ports
>Synopsis:       [vuxml] mail/roundcube vulnerability
>Confidential:   no
>Severity:       non-critical
>Priority:       low
>Responsible:    freebsd-ports-bugs
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          update
>Submitter-Id:   current-users
>Arrival-Date:   Sun Jan 25 04:00:03 UTC 2009
>Closed-Date:
>Last-Modified:
>Originator:     Mark Foster
>Release:        7.1 RELEASE
>Organization:
Credentia
>Environment:
>Description:

>How-To-Repeat:

>Fix:
<vuxml xmlns="http://www.vuxml.org/apps/vuxml-1">
   <vuln vid="a0683fa8-e0c5-4d6d-913a-8850f8ed9583">
     <topic>roundcube -- RoundCube Webmail Background Attributes Email Message HTML Injection Vulnerabili</topic>
     <affects>
       <package>
         <name>roundcube</name>
         <range><le>0.2</le></range>
       </package>
     </affects>
     <description>
       <body xmlns="http://www.w3.org/1999/xhtml">
         <p>SecurityFocus reports:</p>
         <blockquote cite="http://www.securityfocus.com/bid/33372">
           <p>RoundCube Webmail is prone to an HTML-injection vulnerability because the application fails to sufficiently sanitize user-supplied input before using it in dynamically generated content.

Exploiting this issue may allow an attacker to execute HTML and script code in the context of the affected site to steal cookie-based authentication credentials or to control how the site is rendered to the user other attacks are also possible.

RoundCube Webmail 0.2-stable is vulnerable other versions may also be affected.
</p>
         </blockquote>
       </body>
     </description>
     <references>
      <url>http://www.securityfocus.com/bid/33372</url>
      <cvename>CVE-2008-5734</cvename>
      <bid>33372</bid>
     </references>
     <dates>
       <discovery>2009-01-20</discovery>
       <entry>2009-01-24</entry>
     </dates>
   </vuln>


>Release-Note:
>Audit-Trail:
>Unformatted: