CVE-2010-0464: Infoleak
Roundcube 0.3.1 and earlier does not request that the web browser avoid DNS prefetching of domain names contained in e-mail messages, which makes it easier for remote attackers to determine the network location of the webmail user by logging DNS requests.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2010-0464?
The severity of CVE-2010-0464 is classified as medium, as it allows remote attackers to identify the network location of users.
How do I fix CVE-2010-0464?
To fix CVE-2010-0464, upgrade to a version of Roundcube later than 0.3.1 that disables DNS prefetching.
What versions of Roundcube are affected by CVE-2010-0464?
CVE-2010-0464 affects Roundcube versions 0.3.1 and earlier.
Can CVE-2010-0464 lead to information leakage?
Yes, CVE-2010-0464 can lead to information leakage by allowing attackers to infer a user's network location based on DNS requests.
Is there a workaround for CVE-2010-0464?
A temporary workaround for CVE-2010-0464 is to disable email previews that contain links to external domains.