Source: roundcube Version: 1.6.19+dfsg-1 Control: found -1 1.6.19+dfsg-0+deb13u1 Control: found -1 1.6.5+dfsg-1+deb12u12 Severity: important Tags: security upstream X-Debbugs-Cc: Debian Security Team <[email protected]>
Roundcube webmail upstream has just released 1.6.20 [0] which fixes a
new batch of security vulnerabilities:
* Fix IMAP command injection via CRLF in _uid parameter of mail/headers and
mail/viewsource
action
https://github.com/roundcube/roundcubemail/commit/f62879defc0330ae240c72b83b2d00a8ab337447
* Fix bug where an alias login wasn’t qualified by IMAP host
https://github.com/roundcube/roundcubemail/commit/cb235cbfef88cbf78236dc67d3b667bf3dc61ddd
* Add a size limit to the CSS proxy content processing
https://github.com/roundcube/roundcubemail/commit/99a5bdd05b01f45493cc0da4c96968eac7668126
* Fix SSRF filter (is_local_url()) bypass via NAT64 64:ff9b::/96
https://github.com/roundcube/roundcubemail/commit/3c3a65f66b53b7aaf3d720acd06e0b102eceb090
* Fix remote content blocking bypass via SVG SMIL by attribute
https://github.com/roundcube/roundcubemail/commit/2b6ff79d8b14f94b0ff04765b7f02dbfdfe98efa
* Fix remote content blocking bypass via CSS escapes in FuncIRI attributes
(again)
https://github.com/roundcube/roundcubemail/commit/ff4fcfdd2952f9d09947cc9c18137f381f27caf1
* Fix passing potentally unsafe attachment content into ImageMagick on image
resize
https://github.com/roundcube/roundcubemail/commit/895d88af37720d2b46e4553f524013b2e1cb7665
* Fix mail header injection via the From display-name in the Bounce (resend)
action
https://github.com/roundcube/roundcubemail/commit/3a136465c965776a5f636587187626985dae4f3b
* Fix mail header injection via References/In-Reply-To/Message-ID/From
parameters
https://github.com/roundcube/roundcubemail/commit/79adcfc0c48012bbbe930278471425027fd7331c
* Fix object injection primitive in rcube_session::unserialize() via
“!”-prefixed session
keys
https://github.com/roundcube/roundcubemail/commit/833770d3d3c35cfde74cc2614d368f25a75b6f99
* Fix ImageMagick resource limits bypass by GD fallback during thumbnail
generation
https://github.com/roundcube/roundcubemail/commit/0bea81121efd96f07432a837f391dbdd0dffa33f
* Fix CSS scoping bypass in HTML messages using at-rules
https://github.com/roundcube/roundcubemail/commit/ff9cf4a9bf3b7c66db9afe43fe5f1cc73b47ed35
* Fix bug where deprecated action aliases bypassed disabled_actions setting
https://github.com/roundcube/roundcubemail/commit/e7c512ae09ebd0ae5d0d2f29e00a767bf91f6bbe
* Fix IMAP command injection via CRLF in _flag parameter of mail/mark action
https://github.com/roundcube/roundcubemail/commit/242c6d6a150c850bd96d20d400261e71f8d11f9b
* Fix CSRF validation bypass in the mark-as-junk action
https://github.com/roundcube/roundcubemail/commit/15b0dc0d6e5712310c8f663577361bf8132a7f81
* Fix XSS issue in handling of password driver error responses
https://github.com/roundcube/roundcubemail/commit/94298856ee67ff7817cc4def2adb634be91e28c7
* Fix mail header injection via subject of a message forwarded as attachment
https://github.com/roundcube/roundcubemail/commit/c325953a251d0132f1909569b3eac0b974095dd4
* Fix mail header injection via media type in an inline image data URI
https://github.com/roundcube/roundcubemail/commit/adb9b9b3fd43e30af1c166b79494726d89f828eb
* Fix bug where Password Modoboa driver could change password for another
account
https://github.com/roundcube/roundcubemail/commit/3d9d05bfe2da7f93b8d47e68cadab22bb67e6cc9
* Fix unsafe use of a login name in SquirrelMail import file path
https://github.com/roundcube/roundcubemail/commit/15fd175d154311ca7f59cf696c6cc39471611aa6
AFAIK no CVE-ID have been published for these issues. I'm quite busy this week
and will
probably not find time to file MITRE's form before the week-end.
--
Guilhem.
[0] https://roundcube.net/news/2026/10/19/security-updates-1.6.20-and-1.7.5
https://github.com/roundcube/roundcubemail/releases/tag/1.6.20
signature.asc
Description: PGP signature
