RoundCube: Security bypass

RoundCube: Security bypass A vulnerability in RoundCube may allow authenticated users to bypass security restrictions. roundcube 2017-07-08 2017-07-08 618322 remote 1.2.5 1.2.5

Free and open source webmail software for the masses, written in PHP.

Authenticated users can arbitrarily reset passwords due to a problem caused by an improperly restricted exec call in the virtualmin and sasl drivers of the password plugin.

Authenticated users can bypass security restrictions and elevate privileges.

There is no known workaround at this time.

All RoundCube users should upgrade to the latest version:


      # emerge --sync
      # emerge --ask --oneshot --verbose ">=mail-client/roundcube-1.2.5"

CVE-2017-8114 whissi b-man