CVE-2011-4078

include/iniset.php in Roundcube Webmail 0.5.4 and earlier, when PHP 5.3.7 or 5.3.8 is used, allows remote attackers to trigger a GET request for an arbitrary URL, and cause a denial of service (resource consumption and inbox outage), via a Subject header containing only a URL, a related issue to CVE-2011-3379.

Affected Software

Name	Vendor	Start Version	End Version
Webmail	Roundcube	*	0.5.4 (including)
Webmail	Roundcube	0.1 (including)	0.1 (including)
Webmail	Roundcube	0.1-alpha (including)	0.1-alpha (including)
Webmail	Roundcube	0.1-beta (including)	0.1-beta (including)
Webmail	Roundcube	0.1-beta2 (including)	0.1-beta2 (including)
Webmail	Roundcube	0.1-rc1 (including)	0.1-rc1 (including)
Webmail	Roundcube	0.1-rc2 (including)	0.1-rc2 (including)
Webmail	Roundcube	0.1.1 (including)	0.1.1 (including)
Webmail	Roundcube	0.2 (including)	0.2 (including)
Webmail	Roundcube	0.2-alpha (including)	0.2-alpha (including)
Webmail	Roundcube	0.2-beta (including)	0.2-beta (including)
Webmail	Roundcube	0.2.1 (including)	0.2.1 (including)
Webmail	Roundcube	0.3 (including)	0.3 (including)
Webmail	Roundcube	0.3-beta (including)	0.3-beta (including)
Webmail	Roundcube	0.3-rc1 (including)	0.3-rc1 (including)
Webmail	Roundcube	0.3.1 (including)	0.3.1 (including)
Webmail	Roundcube	0.4 (including)	0.4 (including)
Webmail	Roundcube	0.4-beta (including)	0.4-beta (including)
Webmail	Roundcube	0.4.1 (including)	0.4.1 (including)
Webmail	Roundcube	0.4.2 (including)	0.4.2 (including)
Webmail	Roundcube	0.5 (including)	0.5 (including)
Webmail	Roundcube	0.5-beta (including)	0.5-beta (including)
Webmail	Roundcube	0.5-rc (including)	0.5-rc (including)
Webmail	Roundcube	0.5.1 (including)	0.5.1 (including)
Webmail	Roundcube	0.5.2 (including)	0.5.2 (including)
Webmail	Roundcube	0.5.3 (including)	0.5.3 (including)
Roundcube	Ubuntu	artful	*
Roundcube	Ubuntu	cosmic	*
Roundcube	Ubuntu	disco	*
Roundcube	Ubuntu	eoan	*
Roundcube	Ubuntu	groovy	*
Roundcube	Ubuntu	hardy	*
Roundcube	Ubuntu	hirsute	*
Roundcube	Ubuntu	lucid	*
Roundcube	Ubuntu	maverick	*
Roundcube	Ubuntu	natty	*
Roundcube	Ubuntu	oneiric	*
Roundcube	Ubuntu	precise	*
Roundcube	Ubuntu	quantal	*
Roundcube	Ubuntu	raring	*
Roundcube	Ubuntu	saucy	*
Roundcube	Ubuntu	trusty	*
Roundcube	Ubuntu	upstream	*
Roundcube	Ubuntu	utopic	*
Roundcube	Ubuntu	vivid	*
Roundcube	Ubuntu	wily	*
Roundcube	Ubuntu	xenial	*
Roundcube	Ubuntu	yakkety	*
Roundcube	Ubuntu	zesty	*

NVD	https://nvd.nist.gov/vuln/detail/CVE-2011-4078
CWE	https://cwe.mitre.org/data/definitions/399.html

Affected Software

References