{"id":"UBUNTU-CVE-2012-6121","details":"Cross-site scripting (XSS) vulnerability in Roundcube Webmail before 0.8.5 allows remote attackers to inject arbitrary web script or HTML via a (1) data:text or (2) vbscript link.","modified":"2025-07-16T08:10:38.578401Z","published":"2013-02-24T21:55:00Z","withdrawn":"2025-07-18T16:42:48Z","upstream":["CVE-2012-6121"],"references":[{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2012-6121"},{"type":"REPORT","url":"http://www.openwall.com/lists/oss-security/2013/02/07"},{"type":"REPORT","url":"http://trac.roundcube.net/ticket/1488850"},{"type":"REPORT","url":"http://sourceforge.net/news/?group_id=139281&id=310213"},{"type":"REPORT","url":"https://www.cve.org/CVERecord?id=CVE-2012-6121"}],"affected":[{"package":{"name":"roundcube","ecosystem":"Ubuntu:14.04:LTS","purl":"pkg:deb/ubuntu/roundcube@0.9.5-4?arch=source&distro=trusty"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.5-4"}]}],"versions":["0.9.2-2","0.9.4-1","0.9.5-1","0.9.5-2","0.9.5-3","0.9.5-3git1"],"ecosystem_specific":{"binaries":[{"binary_name":"roundcube","binary_version":"0.9.5-4"},{"binary_name":"roundcube-core","binary_version":"0.9.5-4"},{"binary_name":"roundcube-mysql","binary_version":"0.9.5-4"},{"binary_name":"roundcube-pgsql","binary_version":"0.9.5-4"},{"binary_name":"roundcube-plugins","binary_version":"0.9.5-4"},{"binary_name":"roundcube-sqlite3","binary_version":"0.9.5-4"}],"availability":"No subscription required"},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2012/UBUNTU-CVE-2012-6121.json"}}],"schema_version":"1.7.3","severity":[{"type":"Ubuntu","score":"medium"}]}