FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

CVE-2008-5619

This CVE name corresponds to:

Entered	Topic
2008-12-30	roundcube -- remote execution of arbitrary code

The following information is adapted from the Common Vulnerabilities and Exposures (CVE) project. CVE and the CVE logo are trademarks of The MITRE Corporation. CVE content is Copyright 2005, The MITRE Corporation.

CVE-2008-5619 at cve.mitre.org

Details

Type	Candidate
Name	CVE-2008-5619
Phase	Assigned(20081216)

Description

html2text.php in Chuggnutt HTML to Text Converter, as used in RoundCube Webmail (roundcubemail) 0.2-1.alpha and 0.2-3.beta, Mahara, and AtMail Open 1.03, allows remote attackers to execute arbitrary code via crafted input that is processed by the preg_replace function with the eval switch.

References

Source	Reference
BUGTRAQ	20081222 POC for CVE-2008-5619 (roundcubemail PHP arbitrary code injection)
MILW0RM	7549
MILW0RM	7553
MISC	http://trac.roundcube.net/ticket/1485618
CONFIRM	http://sourceforge.net/forum/forum.php?forum_id=898542
CONFIRM	http://trac.roundcube.net/changeset/2148
CONFIRM	http://mahara.org/interaction/forum/topic.php?id=533
FEDORA	FEDORA-2008-11220
FEDORA	FEDORA-2008-11234
MLIST	[oss-security] 20081212 CVE Request - roundcubemail
OSVDB	53893
SECUNIA	33145
SECUNIA	34789
VUPEN	ADV-2008-3418
SECUNIA	33170
VUPEN	ADV-2008-3419