Linux · Security advisory · June 18, 2024
DSA-5714-1: roundcube security update
DSA-5714-1, released June 18, 2024, fixes 1 CVE in roundcube. One of them is being exploited (CVE-2024-37383); 1 on CISA KEV. Patch Radar priority: Patch now.
Patch now1 on CISA KEV
CVEs closed
1
None rated Critical
Exploited
1
CVE-2024-37383
Exploitation more likely
0
Vendor assessment
Highest EPSS
0.7400
99th percentile
Fixed package versions
| Product | Release | Fixed in |
|---|---|---|
| roundcube | Debian 11.6 (bullseye) | 1.4.15+dfsg.1-1+deb11u3 |
| roundcube | Debian 12.15 (bookworm) | 1.6.5+dfsg-1+deb12u2 |
CVEs this fix closes
| Priority | CVE | Title | Impact | CVSS | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| Patch now | CVE-2024-37383 | roundcube: Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 allows XSS via SVG animate attributes. | 6.1 | 0.7400 | KEVExploited |
Showing 1 to 1 of 1
1