------------------------------------------------------------------------- Debian LTS Advisory DLA-4693-1 [email protected] https://www.debian.org/lts/security/ Guilhem Moulin July 22, 2026 https://wiki.debian.org/LTS -------------------------------------------------------------------------
Package : roundcube
Version : 1.4.15+dfsg.1-1+deb11u10 1.6.5+dfsg-1+deb12u10
CVE ID : CVE-2026-54432 CVE-2026-54433 CVE-2026-62641 CVE-2026-62642
CVE-2026-62643 CVE-2026-62644
Debian Bug : 1138086 1141495
Multiple vulnerabilities were discovered in Roundcube, a skinnable AJAX
based webmail solution for IMAP servers, which could result in
cross-site scripting, server-side request forgery, information
disclosure, denial of service, or potentially account takeover.
CVE-2026-54432
Bohdan Kurinnoy discovered that attachment MIME types were neither
sanitized nor escaped on the attachment-validation warning page,
yielding a stored XSS vulnerability.
CVE-2026-54433
Bohdan Kurinnoy discovered that plain-text rendering was subject to
a zero-click stored XSS vulnerability via crafted mailto: URIs.
CVE-2026-62641
It was discovered that the TNEF decoder was subject to Denial of
Service via crafted compressed-RTF size in the winmail.dat
attachment file.
CVE-2026-62642
An infinite loop was discovered in the TNEF decoder, which may lead
to denial of service upon opening an email with a TNEF attachment.
CVE-2026-62643
It was discovered that the CSS sanitization fixes for CVE-2026-35540 and
CVE-2026-48843 were insufficient, allowing a malicious embedded
stylesheet in an HTML email to lead to SSRF or information
disclosure.
CVE-2026-62644
It was discovered that the password plugin was subject to username
spoofing via session data, which could potentially lead to account
takeover.
For Debian 11 bullseye, these problems have been fixed in version
1.4.15+dfsg.1-1+deb11u10.
For Debian 12 bookworm, these problems have been fixed in version
1.6.5+dfsg-1+deb12u10.
We recommend that you upgrade your roundcube packages.
For the detailed security status of roundcube please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/roundcube
Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
signature.asc
Description: PGP signature
