Re: Re: CVE Request - roundcubemail

[Florian Weimer <fw () deneb enyo de>]

* Florian Weimer:

> * Raphael Geissert:
>
> > I became aware of some sort of code execution vulnerability one day
> > before that ticket was reported. After reviewing the file I
> > determined that it isn't a vulnerability in roundcube, but in PHP
> > itself; but I'm open to be proved wrong.
>
> I think this is a documented feature of preg_replace with the "e"
> flag, comparable to what happens when you use string concatenation to
> create SQL statements.

Scratch that, I had an off-by-one error in matching search/replace
terms. 8-(

Therefore, I agree with Raphael that the issue has not been found yet.