On 2026/10/19 16:22, Guilhem Moulin wrote:
Source: roundcube Version: 1.6.19+dfsg-1 Control: found -1 1.6.19+dfsg-0+deb13u1 Control: found -1 1.6.5+dfsg-1+deb12u12 Severity: important Tags: security upstream X-Debbugs-Cc: Debian Security Team <[email protected]> Roundcube webmail upstream has just released 1.6.20 [0] which fixes a new batch of security vulnerabilities: ... AFAIK no CVE-ID have been published for these issues. I'm quite busy this week and will probably not find time to file MITRE's form before the week-end.
Here we go:* Fix IMAP command injection via CRLF in _uid parameter of mail/headers and mail/viewsource
action
https://github.com/roundcube/roundcubemail/commit/f62879defc0330ae240c72b83b2d00a8ab337447
CVE-2026-113386
https://www.cve.org/CVERecord?id=CVE-2026-113386
* Fix bug where an alias login wasn’t qualified by IMAP host
https://github.com/roundcube/roundcubemail/commit/cb235cbfef88cbf78236dc67d3b667bf3dc61ddd
CVE-2026-114732
https://www.cve.org/CVERecord?id=CVE-2026-114732
* Add a size limit to the CSS proxy content processing
https://github.com/roundcube/roundcubemail/commit/99a5bdd05b01f45493cc0da4c96968eac7668126
CVE-2026-114731
https://www.cve.org/CVERecord?id=CVE-2026-114731
* Fix SSRF filter (is_local_url()) bypass via NAT64 64:ff9b::/96
https://github.com/roundcube/roundcubemail/commit/3c3a65f66b53b7aaf3d720acd06e0b102eceb090
CVE-2026-114730
https://www.cve.org/CVERecord?id=CVE-2026-114730
* Fix remote content blocking bypass via SVG SMIL by attribute
https://github.com/roundcube/roundcubemail/commit/2b6ff79d8b14f94b0ff04765b7f02dbfdfe98efa
CVE-2026-114729
https://www.cve.org/CVERecord?id=CVE-2026-114729
* Fix remote content blocking bypass via CSS escapes in FuncIRI
attributes (again)
https://github.com/roundcube/roundcubemail/commit/ff4fcfdd2952f9d09947cc9c18137f381f27caf1
CVE-2026-114728
https://www.cve.org/CVERecord?id=CVE-2026-114728
* Fix passing potentally unsafe attachment content into ImageMagick
on image resize
https://github.com/roundcube/roundcubemail/commit/895d88af37720d2b46e4553f524013b2e1cb7665
CVE-2026-114727
https://www.cve.org/CVERecord?id=CVE-2026-114727
* Fix mail header injection via the From display-name in the Bounce
(resend) action
https://github.com/roundcube/roundcubemail/commit/3a136465c965776a5f636587187626985dae4f3b
CVE-2026-114726
https://www.cve.org/CVERecord?id=CVE-2026-114726
* Fix mail header injection via
References/In-Reply-To/Message-ID/From parameters
https://github.com/roundcube/roundcubemail/commit/79adcfc0c48012bbbe930278471425027fd7331c
CVE-2026-114725
https://www.cve.org/CVERecord?id=CVE-2026-114725
* Fix object injection primitive in rcube_session::unserialize() via
“!”-prefixed session
keys
https://github.com/roundcube/roundcubemail/commit/833770d3d3c35cfde74cc2614d368f25a75b6f99
CVE-2026-114724
https://www.cve.org/CVERecord?id=CVE-2026-114724
https://github.com/roundcube/roundcubemail/commit/0bea81121efd96f07432a837f391dbdd0dffa33f
CVE-2026-114723
https://www.cve.org/CVERecord?id=CVE-2026-114723
* Fix CSS scoping bypass in HTML messages using at-rules
https://github.com/roundcube/roundcubemail/commit/ff9cf4a9bf3b7c66db9afe43fe5f1cc73b47ed35
CVE-2026-114722
https://www.cve.org/CVERecord?id=CVE-2026-114722
* Fix bug where deprecated action aliases bypassed disabled_actions
setting
https://github.com/roundcube/roundcubemail/commit/e7c512ae09ebd0ae5d0d2f29e00a767bf91f6bbe
CVE-2026-114721
https://www.cve.org/CVERecord?id=CVE-2026-114721
* Fix IMAP command injection via CRLF in _flag parameter of mail/mark
action
https://github.com/roundcube/roundcubemail/commit/242c6d6a150c850bd96d20d400261e71f8d11f9b
CVE-2026-114720
https://www.cve.org/CVERecord?id=CVE-2026-114720
* Fix CSRF validation bypass in the mark-as-junk action
https://github.com/roundcube/roundcubemail/commit/15b0dc0d6e5712310c8f663577361bf8132a7f81
CVE-2026-114719
https://www.cve.org/CVERecord?id=CVE-2026-114719
* Fix XSS issue in handling of password driver error responses
https://github.com/roundcube/roundcubemail/commit/94298856ee67ff7817cc4def2adb634be91e28c7
CVE-2026-114718
https://www.cve.org/CVERecord?id=CVE-2026-114718
* Fix mail header injection via subject of a message forwarded as
attachment
https://github.com/roundcube/roundcubemail/commit/c325953a251d0132f1909569b3eac0b974095dd4
CVE-2026-114717
https://www.cve.org/CVERecord?id=CVE-2026-114717
* Fix mail header injection via media type in an inline image data URI
https://github.com/roundcube/roundcubemail/commit/adb9b9b3fd43e30af1c166b79494726d89f828eb
CVE-2026-114716
https://www.cve.org/CVERecord?id=CVE-2026-114716
* Fix bug where Password Modoboa driver could change password for
another account
https://github.com/roundcube/roundcubemail/commit/3d9d05bfe2da7f93b8d47e68cadab22bb67e6cc9
CVE-2026-114715
https://www.cve.org/CVERecord?id=CVE-2026-114715
* Fix unsafe use of a login name in SquirrelMail import file path
https://github.com/roundcube/roundcubemail/commit/15fd175d154311ca7f59cf696c6cc39471611aa6
CVE-2026-114714
https://www.cve.org/CVERecord?id=CVE-2026-114714
--
Edmund Lodewijks <[email protected]>
TZ: UTC+2 / GMT+2
