-------------------------------------------------------------------------------- Fedora EPEL Update Notification FEDORA-EPEL-2026-4e7b9eeb2b 2026-08-20 00:25:04.122552+00:00 --------------------------------------------------------------------------------
Name : roundcubemail Product : Fedora EPEL 10.2 Version : 1.6.18 Release : 1.el10_2 URL : http://www.roundcube.net Summary : Round Cube Webmail is a browser-based multilingual IMAP client Description : RoundCube Webmail is a browser-based multilingual IMAP client with an application-like user interface. It provides full functionality you expect from an e-mail client, including MIME support, address book, folder manipulation, message searching and spell checking. RoundCube Webmail is written in PHP and requires a database: MySQL, PostgreSQL and SQLite are known to work. The user interface is fully skinnable using XHTML and CSS 2. -------------------------------------------------------------------------------- Update Information: Release 1.6.18 Password: Fix fatal error "Class 'Zxcvbn' not found" (#10274) Fix out-of-bounds string reads on truncated compressed-RTF in the TNEF decoder (#10269) Security: Add basic validation for content proxied by the css proxy Security: Fix SSRF bypass via specific local address URLs using 100.64.0.0/10 and fe80::/10 nets Security: Fix SSRF filter bypass via various forms of nip.io/sslip.io hostnames evading is_local_url() check Security: Fix remote content blocking bypass via unclosed url() in a FuncIRI attribute Security: Fix LDAP filter injection via unescaped %u/%fu/%d substitution into the search_filter Security: Fix arbitrary Sieve script injection via a filter rule name bypassing managesieve_disabled_actions Security: Fix RCE via cmd_learn driver of markasjunk plugin Security: Fix IMAP command injection via mail search and LITERAL+ byte-count desynchronization Security: Fix password's modoboa driver leak of an authentication token to a user-controlled host Security: Fix stored XSS in "Add to address book" action Security: Fix HTML/CSS sanitization bypass via SVG animate by attribute -------------------------------------------------------------------------------- ChangeLog: * Mon Aug 10 2026 Remi Collet <[email protected]> - 1.6.18-1 - update to 1.6.18 -------------------------------------------------------------------------------- References: [ 1 ] Bug #2488277 - CVE-2026-48998 roundcubemail: guzzlehttp/psr7: Information disclosure via improper Host header validation [epel-all] https://bugzilla.redhat.com/show_bug.cgi?id=2488277 [ 2 ] Bug #2489109 - CVE-2026-49214 roundcubemail: `guzzlehttp/psr7`: Request Smuggling and Cache Poisoning via HTTP Header Injection [epel-all] https://bugzilla.redhat.com/show_bug.cgi?id=2489109 [ 3 ] Bug #2491783 - CVE-2026-55766 roundcubemail: guzzlehttp/psr7: Information disclosure due to improper handling of CR/LF characters in HTTP start-line fields [epel-all] https://bugzilla.redhat.com/show_bug.cgi?id=2491783 [ 4 ] Bug #2491786 - CVE-2026-55767 roundcubemail: Guzzle: Cookie injection and session fixation due to improper domain validation [epel-all] https://bugzilla.redhat.com/show_bug.cgi?id=2491786 [ 5 ] Bug #2491793 - CVE-2026-55568 roundcubemail: Guzzle: Information disclosure via cleartext proxy communication [epel-all] https://bugzilla.redhat.com/show_bug.cgi?id=2491793 [ 6 ] Bug #2499192 - CVE-2026-59882 roundcubemail: guzzlehttp/psr7: URI host validation flaw can lead to security bypass or misrouting [epel-all] https://bugzilla.redhat.com/show_bug.cgi?id=2499192 [ 7 ] Bug #2508376 - CVE-2026-59883 roundcubemail: Guzzle: Cross-host cookie disclosure and injection due to improper domain matching in CookieJar. [epel-all] https://bugzilla.redhat.com/show_bug.cgi?id=2508376 -------------------------------------------------------------------------------- This update can be installed with the "yum" update programs. Use su -c 'yum update roundcubemail' at the command line. For more information, refer to "YUM", available at https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7\ /html/System_Administrators_Guide/ch-yum.html All packages are signed with the Fedora EPEL GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/keys -------------------------------------------------------------------------------- -- _______________________________________________ epel-package-announce mailing list -- [email protected] To unsubscribe send an email to [email protected] Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/[email protected] Do not reply to spam, report it: https://forge.fedoraproject.org/infra/tickets/issues/new
