Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
b56bbe81 by Salvatore Bonaccorso at 2026-09-06T17:08:35+02:00
Track fixed version for roundcube issues
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -1,39 +1,39 @@
CVE-2026-XXXX [CSS declaration smuggling via un-encoded ampersand emission]
- - roundcube <unfixed> (bug #1146838)
+ - roundcube 1.6.19+dfsg-1 (bug #1146838)
NOTE: Fixed by:
https://github.com/roundcube/roundcubemail/commit/8119eb061bffd6d967ee34e7bda21e20237fc1e0
(1.6.19)
CVE-2026-XXXX [CSS property injection via body `background` attribute]
- - roundcube <unfixed> (bug #1146838)
+ - roundcube 1.6.19+dfsg-1 (bug #1146838)
NOTE: Fixed by:
https://github.com/roundcube/roundcubemail/commit/030de9a4e58699a336f62868017ea5271128c52f
(1.6.19)
NOTE: Follow-up:
https://github.com/roundcube/roundcubemail/commit/3092bd9fbe65b243cf419352ddd3e53e5086c6cc
(1.6.19)
NOTE: Follow-up:
https://github.com/roundcube/roundcubemail/commit/2869de81c94dee300df4193276cce588f10350e1
(1.6.19)
NOTE: Follow-up:
https://github.com/roundcube/roundcubemail/commit/29beae7282135a3cd59a3945bd33ee8f904d6217
(1.6.19)
CVE-2026-XXXX [Email header injection via bare CR in the subject field]
- - roundcube <unfixed> (bug #1146838)
+ - roundcube 1.6.19+dfsg-1 (bug #1146838)
NOTE: Fixed by:
https://github.com/roundcube/roundcubemail/commit/73d864e06cb26000a37ad57ae439842a85b6690e
(1.6.19)
CVE-2026-XXXX [Email header injection via C-escape \r in the recipient display
name]
- - roundcube <unfixed> (bug #1146838)
+ - roundcube 1.6.19+dfsg-1 (bug #1146838)
NOTE: Fixed by:
https://github.com/roundcube/roundcubemail/commit/d1238ef1fb0d66a9bacf6b01926b911f70515071
(1.6.19)
CVE-2026-XXXX [Email header injection via identity's organization field]
- - roundcube <unfixed> (bug #1146838)
+ - roundcube 1.6.19+dfsg-1 (bug #1146838)
NOTE: Fixed by:
https://github.com/roundcube/roundcubemail/commit/11e5c9be0369e3b76bfee2ae095f57532bae0f1f
(1.6.19)
CVE-2026-XXXX [Zero-click stored XSS via TNEF MIME tag injection in the
attachment URL]
- - roundcube <unfixed> (bug #1146838)
+ - roundcube 1.6.19+dfsg-1 (bug #1146838)
NOTE: Fixed by:
https://github.com/roundcube/roundcubemail/commit/e4a0f82f4c648606de0867ee16b4a5f591ddbd69
(1.6.19)
NOTE: Follow-up:
https://github.com/roundcube/roundcubemail/commit/7095e8d9de10d2f8bb90c3639c582edf8e371d5c
(1.6.19)
CVE-2026-XXXX [XSS in the HTML editor using text/enriched part content]
- - roundcube <unfixed> (bug #1146838)
+ - roundcube 1.6.19+dfsg-1 (bug #1146838)
NOTE: Fixed by:
https://github.com/roundcube/roundcubemail/commit/1381bf5d7e4c595560acf0228a2e68e471cefbd8
(1.6.19)
CVE-2026-XXXX [Cross-user access in contact group membership (add/remove) in
the SQL address book]
- - roundcube <unfixed> (bug #1146838)
+ - roundcube 1.6.19+dfsg-1 (bug #1146838)
NOTE: Fixed by:
https://github.com/roundcube/roundcubemail/commit/19ba077a859b590bd886b437a6c8a3fdd8aa3952
(1.6.19)
CVE-2026-XXXX [`is_local_url()` bypass via trailing-dot FQDN in stylesheet URL]
- - roundcube <unfixed> (bug #1146838)
+ - roundcube 1.6.19+dfsg-1 (bug #1146838)
NOTE: Fixed by:
https://github.com/roundcube/roundcubemail/commit/9c4099bbff33062c8ab6e09d9b71e59dde295408
(1.6.19)
CVE-2026-XXXX [Remote content blocking bypass via CSS escapes in FuncIRI
attributes]
- - roundcube <unfixed> (bug #1146838)
+ - roundcube 1.6.19+dfsg-1 (bug #1146838)
NOTE: Fixed by:
https://github.com/roundcube/roundcubemail/commit/9aa2b3f13c3707ac24aee9899dd4ab693ee1e471
(1.6.19)
CVE-2026-XXXX [Remote-content blocker bypass via SVG SMIL src animation]
- - roundcube <unfixed> (bug #1146838)
+ - roundcube 1.6.19+dfsg-1 (bug #1146838)
NOTE: Fixed by:
https://github.com/roundcube/roundcubemail/commit/2bed9eeb5707636b8e5b915ae18d4d06b3971f31
(1.6.19)
CVE-2026-XXXX [SSRF bypass in Roundcube CSS proxy via hexadecimal IPv6-mapped
IPv4 addresses]
- roundcube 1.6.14+dfsg-1 (bug #1146838)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/b56bbe81e55f6c4681d28bb7ea29fc9a4bc78e83
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/b56bbe81e55f6c4681d28bb7ea29fc9a4bc78e83
You're receiving this email because of your account on salsa.debian.org. Manage
all notifications: https://salsa.debian.org/-/profile/notifications | Help:
https://salsa.debian.org/help
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
