CVE-2016-9920

Name of the Vulnerable Software and Affected Versions Roundcube versions prior to 1.1.7 Roundcube versions 1.2.x prior to 1.2.3

Description The issue allows remote authenticated users to execute arbitrary code via a modified HTTP request that sends a crafted e-mail message. This is due to the improper restriction of custom envelope-from addresses on the sendmail command line when no SMTP server is configured and the sendmail program is enabled.

Recommendations For Roundcube versions prior to 1.1.7, update to version 1.1.7 or later. For Roundcube versions 1.2.x prior to 1.2.3, update to version 1.2.3 or later.