Created attachment 187870 [details] Update roundcube to 1.3.3 A security vulnerability has been discovered in Roundcube, and "... is already being used by hackers to read Roundcube’s configuration files. It requires a valid username/password as the exploit only works with a valid session. More details will be published soon under CVE-2017-16651." * https://roundcube.net/news/2017/11/08/security-updates-1.3.3-1.2.7-and-1.1.10 Attached is a version bump patch. Builds with Poudriere, 11.1, amd64. VuXML entry pending.
A commit references this bug: Author: ale Date: Thu Nov 9 06:56:53 UTC 2017 New revision: 453797 URL: https://svnweb.freebsd.org/changeset/ports/453797 Log: Update to 1.3.3 release. Fix security vulnerability (CVE-2017-16651). PR: 223547 Submitted by: Vladimir Krstulja <vlad-fbsd@acheronmedia.com> Changes: head/mail/roundcube/Makefile head/mail/roundcube/distinfo
Thanks for the commit, but please also merge quarterly.
Resolution depends on users being aware (VuXML)
A commit references this bug: Author: dbaio Date: Sat Nov 11 18:02:38 UTC 2017 New revision: 453983 URL: https://svnweb.freebsd.org/changeset/ports/453983 Log: MFH: r453797 Update to 1.3.3 release. Fix security vulnerability (CVE-2017-16651). PR: 223547 Submitted by: Vladimir Krstulja <vlad-fbsd@acheronmedia.com> Approved by: ports-secteam (swills) Changes: _U branches/2017Q4/ branches/2017Q4/mail/roundcube/Makefile branches/2017Q4/mail/roundcube/distinfo