{"action":"Upgrade roundcube to 0.6+dfsg-1 or later.","affected":[{"fixed":"0.6+dfsg-1","introduced":"0"}],"component":"roundcube","cve_ids":[],"ecosystem":"Debian","ecosystem_qualifier":"Debian:12","exploited":false,"fixed_versions":["0.6+dfsg-1"],"id":"tcs_01M5N9WCDRFEVG0W7Q5ACXBT0M","modified_at":"2026-10-23T17:47:48.555534626Z","published_at":"2011-11-03T15:55:00.887Z","references":["https://osv.dev/vulnerability/DEBIAN-CVE-2011-4078","https://security-tracker.debian.org/tracker/CVE-2011-4078"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"DEBIAN-CVE-2011-4078","url":"https://osv.dev/vulnerability/DEBIAN-CVE-2011-4078"}],"summary":"include/iniset.php in Roundcube Webmail 0.5.4 and earlier, when PHP 5.3.7 or 5.3.8 is used, allows remote attackers to trigger a GET request for an arbitrary URL, and cause a denial of service (resour"}