[<prev] [next>] [day] [month] [year] [list]
Message-ID: <aiBrH_PyoInfBtJj@donburi.himad.notcom.org>
Date: Wed, 3 Jun 2026 21:08:07 +0300
From: Valtteri Vuorikoski <vuori@...com.org>
To: oss-security@...ts.openwall.com
Subject: CVE-2026-48842+more: Roundcube numerous vulnerabilities prior to
1.6.16/1.7.1
Roundcube, a webmail frontend, released versions 1.6.16 and 1.7.1 on May 24 that
fix a variety of vulnerabilities. From the announcement
<https://roundcube.net/news/2026/05/24/security-updates-1.6.16-and-1.7.1>:
* Fix stored XSS/HTML/CSS injection in subject field of the draft restore
dialog, reported by zazy
* Fix CSS injection bypass in HTML sanitizer via SVG <animate
attributeName="style">, reported by wooseokdotkim
* Fix pre-auth SQL injection in virtuser_query plugin via preg_replace
backslash escape bypass, reported by skull
* Fix SSRF bypass via specific local address URLs
* Fix local/private URL fetch bypass when remote resources were not allowed,
reported by Orange Cyberdefense Vulnerability Disclosure Team
* Fix bypass of remote image blocking via CSS var(), reported by Geame
* Fix pre-auth arbitrary file delete via redis/memcache session poisoning
bypass, reported by valent1
* Fix code injection vulnerability - remove support for code evaluation in
LDAP autovalues option, reported by Glendaenri
As usual, CVE numbers are not provided in the announcement. See for example
<https://security-tracker.debian.org/tracker/source-package/roundcube> for a
list if interested.
Support for the 1.5 LTS branch has ended, so presumably it is and will remain
vulnerable to some or all of these.
-Valtteri
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
