Roundcube before 1.4.13 and 1.5.x before 1.5.2 allows XSS via an HTML e-mail message with crafted Cascading Style Sheets (CSS) token sequences.

Fix status by distribution

Fixed packages published by each distribution for this CVE

• Debian DEBIAN-CVE-2021-46144 roundcube Fixed in: 1.4.13+dfsg.1-1~deb11u1

References

• advisory bugs.debian.org
• advisory lists.debian.org
• advisory roundcube.net
• advisory roundcube.net
• advisory debian.org
• patch github.com
• patch github.com