CVE catalog
CVE-2019-10740
roundcube: CVE-2019-10740
- Severity
- Medium · CVSS 4.3
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N - Published
- Source
- [NVD] · [CVE record]
- EPSS
- 0.77% · Oct 25, 2026
In Roundcube Webmail before 1.3.10, an attacker in possession of S/MIME or PGP encrypted emails can wrap them as sub-parts within a crafted multipart email. The encrypted part(s) can further be hidden using HTML/CSS or ASCII newline characters. This modified multipart email can be re-sent by the attacker to the intended receiver. If the receiver replies to this (benign looking) email, they unknowingly leak the plaintext of the encrypted message part(s) back to the attacker.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | roundcube | sid | 1.6.20+dfsg-1 | fixed |
| Debian | roundcube | forky | 1.6.20+dfsg-1 | fixed |
| Debian | roundcube | trixie | 1.6.18+dfsg-0+deb13u1 | fixed |
| Debian | roundcube | trixie-security | 1.6.20+dfsg-0+deb13u1 | fixed |
| Debian | roundcube | bookworm | 1.6.5+dfsg-1+deb12u9 | fixed |
| Debian | roundcube | bookworm-security | 1.6.5+dfsg-1+deb12u12 | fixed |
| Ubuntu | roundcube | pro | 1.3.0+dfsg.1-1 | vulnerable |
| Ubuntu | roundcube | pro | 1.3.1+dfsg.1-1 | vulnerable |
| Ubuntu | roundcube | pro | 1.3.3+dfsg.1-1 | vulnerable |
| Ubuntu | roundcube | pro | 1.3.3+dfsg.1-2 | vulnerable |
| Ubuntu | roundcube | pro | 1.3.6+dfsg.1-1 | vulnerable |
| Ubuntu | roundcube | pro | 1.3.6+dfsg.1-1ubuntu0.1~esm1 | vulnerable |
| Ubuntu | roundcube | pro | 1.3.6+dfsg.1-1ubuntu0.1~esm2 | vulnerable |
| Ubuntu | roundcube | pro | 1.3.6+dfsg.1-1ubuntu0.1~esm3 | vulnerable |
| Ubuntu | roundcube | pro | 1.3.6+dfsg.1-1ubuntu0.1~esm4 | vulnerable |
| Ubuntu | roundcube | pro | 1.3.6+dfsg.1-1ubuntu0.1~esm5 | vulnerable |
| Ubuntu | roundcube | pro | 1.3.6+dfsg.1-1ubuntu0.1~esm6 | vulnerable |
| Ubuntu | roundcube | pro | 1.3.6+dfsg.1-1ubuntu0.1~esm7 | fixed |
| Suse | roundcubemail | package hub 15 sp1 | 1.3.15-bp152.4.3.1 | fixed |
| Suse | roundcubemail | package hub 15 sp2 | 1.3.15-bp152.4.3.1 | fixed |
| Opensuse | roundcubemail | leap 15.1 | 1.3.15-bp152.4.3.1 | fixed |
| Opensuse | roundcubemail | leap 15.2 | 1.3.15-bp152.4.3.1 | fixed |
| Suse | roundcubemail | package hub 15 sp3 | 1.5.3-bp154.2.3.1 | fixed |
| Suse | roundcubemail | package hub 15 sp4 | 1.5.3-bp154.2.3.1 | fixed |
| Opensuse | roundcubemail | leap 15.3 | 1.5.3-bp154.2.3.1 | fixed |
| Opensuse | roundcubemail | leap 15.4 | 1.5.3-bp154.2.3.1 | fixed |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | roundcube | source | sid | 1.3.10+dfsg.1-1 | not yet assigned | Not reported | [927713] |
| Debian | roundcube | source | forky | 1.3.10+dfsg.1-1 | not yet assigned | Not reported | [927713] |
| Debian | roundcube | source | trixie | 1.3.10+dfsg.1-1 | not yet assigned | Not reported | [927713] |
| Debian | roundcube | source | bookworm | 1.3.10+dfsg.1-1 | not yet assigned | Not reported | [927713] |
| Ubuntu | roundcube | deb | pro | 1.3.6+dfsg.1-1ubuntu0.1~esm7 | Not reported | UBUNTU-CVE-2019-10740 | Not reported |
| Suse | roundcubemail | rpm | package hub 15 sp1 | 1.3.15-bp152.4.3.1 | Not reported | OPENSUSE-SU-2020:1516-1 | Not reported |
| Suse | roundcubemail | rpm | package hub 15 sp2 | 1.3.15-bp152.4.3.1 | Not reported | OPENSUSE-SU-2020:1516-1 | Not reported |
| Opensuse | roundcubemail | rpm | leap 15.1 | 1.3.15-bp152.4.3.1 | Not reported | OPENSUSE-SU-2020:1516-1 | Not reported |
| Opensuse | roundcubemail | rpm | leap 15.2 | 1.3.15-bp152.4.3.1 | Not reported | OPENSUSE-SU-2020:1516-1 | Not reported |
| Suse | roundcubemail | rpm | package hub 15 sp3 | 1.5.3-bp154.2.3.1 | Not reported | OPENSUSE-SU-2022:10148-1 | Not reported |
| Suse | roundcubemail | rpm | package hub 15 sp4 | 1.5.3-bp154.2.3.1 | Not reported | OPENSUSE-SU-2022:10148-1 | Not reported |
| Opensuse | roundcubemail | rpm | leap 15.3 | 1.5.3-bp154.2.3.1 | Not reported | OPENSUSE-SU-2022:10148-1 | Not reported |
| Opensuse | roundcubemail | rpm | leap 15.4 | 1.5.3-bp154.2.3.1 | Not reported | OPENSUSE-SU-2022:10148-1 | Not reported |
OpenFactory catalog packages
Matching against OpenFactory catalog package versions is in progress.
[Debian 12 (Bookworm)]
- [roundcube]Unknown
Details (4)
1.6.5+dfsg-1+deb12u9· all · bookwormFixed · Fixed:
1.3.10+dfsg.1-1dsa · roundcube · debian · bookworm; dsa · roundcube · debian · 12
1.6.5+dfsg-1+deb12u9· all · bookwormFixed · Fixed:
1.3.10+dfsg.1-1dsa · roundcube · debian · bookworm; dsa · roundcube · debian · 12
1.6.5+dfsg-1+deb12u11· all · bookworm-securityFixed · Fixed:
1.3.10+dfsg.1-1dsa · roundcube · debian · bookworm; dsa · roundcube · debian · 12
1.6.5+dfsg-1+deb12u11· all · bookworm-securityFixed · Fixed:
1.3.10+dfsg.1-1dsa · roundcube · debian · bookworm; dsa · roundcube · debian · 12
- [roundcube-core]Unknown
Source package: [roundcube]
Details (4)
1.6.5+dfsg-1+deb12u9· all · bookwormFixed · Fixed:
1.3.10+dfsg.1-1dsa · roundcube · debian · bookworm; dsa · roundcube · debian · 12
1.6.5+dfsg-1+deb12u9· all · bookwormFixed · Fixed:
1.3.10+dfsg.1-1dsa · roundcube · debian · bookworm; dsa · roundcube · debian · 12
1.6.5+dfsg-1+deb12u11· all · bookworm-securityFixed · Fixed:
1.3.10+dfsg.1-1dsa · roundcube · debian · bookworm; dsa · roundcube · debian · 12
1.6.5+dfsg-1+deb12u11· all · bookworm-securityFixed · Fixed:
1.3.10+dfsg.1-1dsa · roundcube · debian · bookworm; dsa · roundcube · debian · 12
- [roundcube-mysql]Unknown
Source package: [roundcube]
Details (4)
1.6.5+dfsg-1+deb12u9· all · bookwormFixed · Fixed:
1.3.10+dfsg.1-1dsa · roundcube · debian · bookworm; dsa · roundcube · debian · 12
1.6.5+dfsg-1+deb12u9· all · bookwormFixed · Fixed:
1.3.10+dfsg.1-1dsa · roundcube · debian · bookworm; dsa · roundcube · debian · 12
1.6.5+dfsg-1+deb12u11· all · bookworm-securityFixed · Fixed:
1.3.10+dfsg.1-1dsa · roundcube · debian · bookworm; dsa · roundcube · debian · 12
1.6.5+dfsg-1+deb12u11· all · bookworm-securityFixed · Fixed:
1.3.10+dfsg.1-1dsa · roundcube · debian · bookworm; dsa · roundcube · debian · 12
- [roundcube-pgsql]Unknown
Source package: [roundcube]
Details (4)
1.6.5+dfsg-1+deb12u9· all · bookwormFixed · Fixed:
1.3.10+dfsg.1-1dsa · roundcube · debian · bookworm; dsa · roundcube · debian · 12
1.6.5+dfsg-1+deb12u9· all · bookwormFixed · Fixed:
1.3.10+dfsg.1-1dsa · roundcube · debian · bookworm; dsa · roundcube · debian · 12
1.6.5+dfsg-1+deb12u11· all · bookworm-securityFixed · Fixed:
1.3.10+dfsg.1-1dsa · roundcube · debian · bookworm; dsa · roundcube · debian · 12
1.6.5+dfsg-1+deb12u11· all · bookworm-securityFixed · Fixed:
1.3.10+dfsg.1-1dsa · roundcube · debian · bookworm; dsa · roundcube · debian · 12
- [roundcube-plugins]Unknown
Source package: [roundcube]
Details (4)
1.6.5+dfsg-1+deb12u9· all · bookwormFixed · Fixed:
1.3.10+dfsg.1-1dsa · roundcube · debian · bookworm; dsa · roundcube · debian · 12
1.6.5+dfsg-1+deb12u9· all · bookwormFixed · Fixed:
1.3.10+dfsg.1-1dsa · roundcube · debian · bookworm; dsa · roundcube · debian · 12
1.6.5+dfsg-1+deb12u11· all · bookworm-securityFixed · Fixed:
1.3.10+dfsg.1-1dsa · roundcube · debian · bookworm; dsa · roundcube · debian · 12
1.6.5+dfsg-1+deb12u11· all · bookworm-securityFixed · Fixed:
1.3.10+dfsg.1-1dsa · roundcube · debian · bookworm; dsa · roundcube · debian · 12
- [roundcube-sqlite3]Unknown
Source package: [roundcube]
Details (4)
1.6.5+dfsg-1+deb12u9· all · bookwormFixed · Fixed:
1.3.10+dfsg.1-1dsa · roundcube · debian · bookworm; dsa · roundcube · debian · 12
1.6.5+dfsg-1+deb12u9· all · bookwormFixed · Fixed:
1.3.10+dfsg.1-1dsa · roundcube · debian · bookworm; dsa · roundcube · debian · 12
1.6.5+dfsg-1+deb12u11· all · bookworm-securityFixed · Fixed:
1.3.10+dfsg.1-1dsa · roundcube · debian · bookworm; dsa · roundcube · debian · 12
1.6.5+dfsg-1+deb12u11· all · bookworm-securityFixed · Fixed:
1.3.10+dfsg.1-1dsa · roundcube · debian · bookworm; dsa · roundcube · debian · 12
[Debian 13 (Trixie)]
- [roundcube]Unknown
Details (7)
1.6.16+dfsg-0+deb13u1· all · trixieFixed · Fixed:
1.3.10+dfsg.1-1dsa · roundcube · debian · 13
1.6.16+dfsg-0+deb13u1· all · trixieFixed · Fixed:
1.3.10+dfsg.1-1dsa · roundcube · debian · 13
1.6.17+dfsg-0+deb13u1· all · trixie-security · Historical versionFixed · Fixed:
1.3.10+dfsg.1-1dsa · roundcube · debian · 13
1.6.18+dfsg-0+deb13u1· all · trixie-security · Historical versionFixed · Fixed:
1.3.10+dfsg.1-1dsa · roundcube · debian · 13
1.6.18+dfsg-0+deb13u1· all · trixie-securityFixed · Fixed:
1.3.10+dfsg.1-1dsa · roundcube · debian · 13
1.6.19+dfsg-0+deb13u1· all · trixie-security · Historical versionFixed · Fixed:
1.3.10+dfsg.1-1dsa · roundcube · debian · 13
1.6.20+dfsg-0+deb13u1· all · trixie-securityFixed · Fixed:
1.3.10+dfsg.1-1dsa · roundcube · debian · 13
- [roundcube-core]Unknown
Source package: [roundcube]
Details (7)
1.6.16+dfsg-0+deb13u1· all · trixieFixed · Fixed:
1.3.10+dfsg.1-1dsa · roundcube · debian · 13
1.6.16+dfsg-0+deb13u1· all · trixieFixed · Fixed:
1.3.10+dfsg.1-1dsa · roundcube · debian · 13
1.6.17+dfsg-0+deb13u1· all · trixie-security · Historical versionFixed · Fixed:
1.3.10+dfsg.1-1dsa · roundcube · debian · 13
1.6.18+dfsg-0+deb13u1· all · trixie-security · Historical versionFixed · Fixed:
1.3.10+dfsg.1-1dsa · roundcube · debian · 13
1.6.18+dfsg-0+deb13u1· all · trixie-securityFixed · Fixed:
1.3.10+dfsg.1-1dsa · roundcube · debian · 13
1.6.19+dfsg-0+deb13u1· all · trixie-security · Historical versionFixed · Fixed:
1.3.10+dfsg.1-1dsa · roundcube · debian · 13
1.6.20+dfsg-0+deb13u1· all · trixie-securityFixed · Fixed:
1.3.10+dfsg.1-1dsa · roundcube · debian · 13
- [roundcube-mysql]Unknown
Source package: [roundcube]
Details (7)
1.6.16+dfsg-0+deb13u1· all · trixieFixed · Fixed:
1.3.10+dfsg.1-1dsa · roundcube · debian · 13
1.6.16+dfsg-0+deb13u1· all · trixieFixed · Fixed:
1.3.10+dfsg.1-1dsa · roundcube · debian · 13
1.6.17+dfsg-0+deb13u1· all · trixie-security · Historical versionFixed · Fixed:
1.3.10+dfsg.1-1dsa · roundcube · debian · 13
1.6.18+dfsg-0+deb13u1· all · trixie-securityFixed · Fixed:
1.3.10+dfsg.1-1dsa · roundcube · debian · 13
1.6.18+dfsg-0+deb13u1· all · trixie-security · Historical versionFixed · Fixed:
1.3.10+dfsg.1-1dsa · roundcube · debian · 13
1.6.19+dfsg-0+deb13u1· all · trixie-security · Historical versionFixed · Fixed:
1.3.10+dfsg.1-1dsa · roundcube · debian · 13
1.6.20+dfsg-0+deb13u1· all · trixie-securityFixed · Fixed:
1.3.10+dfsg.1-1dsa · roundcube · debian · 13
- [roundcube-pgsql]Unknown
Source package: [roundcube]
Details (7)
1.6.16+dfsg-0+deb13u1· all · trixieFixed · Fixed:
1.3.10+dfsg.1-1dsa · roundcube · debian · 13
1.6.16+dfsg-0+deb13u1· all · trixieFixed · Fixed:
1.3.10+dfsg.1-1dsa · roundcube · debian · 13
1.6.17+dfsg-0+deb13u1· all · trixie-security · Historical versionFixed · Fixed:
1.3.10+dfsg.1-1dsa · roundcube · debian · 13
1.6.18+dfsg-0+deb13u1· all · trixie-security · Historical versionFixed · Fixed:
1.3.10+dfsg.1-1dsa · roundcube · debian · 13
1.6.18+dfsg-0+deb13u1· all · trixie-securityFixed · Fixed:
1.3.10+dfsg.1-1dsa · roundcube · debian · 13
1.6.19+dfsg-0+deb13u1· all · trixie-security · Historical versionFixed · Fixed:
1.3.10+dfsg.1-1dsa · roundcube · debian · 13
1.6.20+dfsg-0+deb13u1· all · trixie-securityFixed · Fixed:
1.3.10+dfsg.1-1dsa · roundcube · debian · 13
- [roundcube-plugins]Unknown
Source package: [roundcube]
Details (7)
1.6.16+dfsg-0+deb13u1· all · trixieFixed · Fixed:
1.3.10+dfsg.1-1dsa · roundcube · debian · 13
1.6.16+dfsg-0+deb13u1· all · trixieFixed · Fixed:
1.3.10+dfsg.1-1dsa · roundcube · debian · 13
1.6.17+dfsg-0+deb13u1· all · trixie-security · Historical versionFixed · Fixed:
1.3.10+dfsg.1-1dsa · roundcube · debian · 13
1.6.18+dfsg-0+deb13u1· all · trixie-securityFixed · Fixed:
1.3.10+dfsg.1-1dsa · roundcube · debian · 13
1.6.18+dfsg-0+deb13u1· all · trixie-security · Historical versionFixed · Fixed:
1.3.10+dfsg.1-1dsa · roundcube · debian · 13
1.6.19+dfsg-0+deb13u1· all · trixie-security · Historical versionFixed · Fixed:
1.3.10+dfsg.1-1dsa · roundcube · debian · 13
1.6.20+dfsg-0+deb13u1· all · trixie-securityFixed · Fixed:
1.3.10+dfsg.1-1dsa · roundcube · debian · 13
- [roundcube-sqlite3]Unknown
Source package: [roundcube]
Details (7)
1.6.16+dfsg-0+deb13u1· all · trixieFixed · Fixed:
1.3.10+dfsg.1-1dsa · roundcube · debian · 13
1.6.16+dfsg-0+deb13u1· all · trixieFixed · Fixed:
1.3.10+dfsg.1-1dsa · roundcube · debian · 13
1.6.17+dfsg-0+deb13u1· all · trixie-security · Historical versionFixed · Fixed:
1.3.10+dfsg.1-1dsa · roundcube · debian · 13
1.6.18+dfsg-0+deb13u1· all · trixie-securityFixed · Fixed:
1.3.10+dfsg.1-1dsa · roundcube · debian · 13
1.6.18+dfsg-0+deb13u1· all · trixie-security · Historical versionFixed · Fixed:
1.3.10+dfsg.1-1dsa · roundcube · debian · 13
1.6.19+dfsg-0+deb13u1· all · trixie-security · Historical versionFixed · Fixed:
1.3.10+dfsg.1-1dsa · roundcube · debian · 13
1.6.20+dfsg-0+deb13u1· all · trixie-securityFixed · Fixed:
1.3.10+dfsg.1-1dsa · roundcube · debian · 13
Observed:
References
- [https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2020_1516-1.json]
- [https://osv.dev/vulnerability/DEBIAN-CVE-2019-10740]
- [https://osv.dev/vulnerability/UBUNTU-CVE-2019-10740]
- [https://osv.dev/vulnerability/openSUSE-SU-2020:1516-1]
- [https://osv.dev/vulnerability/openSUSE-SU-2022:10148-1]
- [https://security-tracker.debian.org/tracker/CVE-2019-10740]
[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]