ASA-202102-27 log original external raw

[ASA-202102-27] roundcubemail: cross-site scripting
Arch Linux Security Advisory ASA-202102-27 ========================================== Severity: High Date : 2021-02-12 CVE-ID : CVE-2021-26925 Package : roundcubemail Type : cross-site scripting Remote : Yes Link : Summary ======= The package roundcubemail before version 1.4.11-1 is vulnerable to cross-site scripting. Resolution ========== Upgrade to 1.4.11-1. # pacman -Syu "roundcubemail>=1.4.11-1" The problem has been fixed upstream in version 1.4.11. Workaround ========== None. Description =========== Roundcube before 1.4.11 allows cross-site scripting (XSS) via crafted Cascading Style Sheets (CSS) token sequences during HTML email rendering. Impact ====== A remote attacker might be able to perform cross-site scripting via crafted CSS content in a HTML message. References ==========