CVE-2016-4068 Cross-site scripting in n/a

What is CVE-2016-4068?

CVE-2016-4068 is a medium-severity cross-site scripting vulnerability in Opensuse Leap, published on 13 Apr 2017. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Cross-site scripting (XSS) vulnerability in Roundcube Webmail before 1.0.9 and 1.1.x before 1.1.5 allows remote attackers to inject arbitrary web script or HTML via a crafted SVG, a different vulnerability than CVE-2015-8864.

Weakness: CWE-79

Which versions are affected by CVE-2016-4068?

It affects 4 products.

Products include Opensuse Leap, Opensuse Opensuse, Roundcube Roundcube Webmail, Roundcube Webmail.

How do I fix CVE-2016-4068?

Upgrade to a fixed version.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2016-4068 being exploited?

There is no known exploitation of CVE-2016-4068 in the wild and no public exploit code.

Other vulnerabilities in Opensuse Leap

• CVE-2015-4902 Oracle Java SE Integrity Check Exploited Medium 5.3
• CVE-2017-14804 package builds could use directory traversal to write outside of target area Critical 9.9
• CVE-2019-20787 Teeworlds before 0.7.4 has an integer overflow when computing a tilemap size. Critical 9.8
• CVE-2019-8341 Code injection in n/a Critical 9.8
• CVE-2019-6438 Other in n/a Critical 9.8

All Opensuse Leap vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2016-4068, GHSA-4rqp-f36w-28hw, UBUNTU-CVE-2016-4068.