diff --git a/patchinfo.20260304200727360655.93181000773252/_patchinfo b/patchinfo.20260304200727360655.93181000773252/_patchinfo new file mode 100644 index 0000000..cc62506 --- /dev/null +++ b/patchinfo.20260304200727360655.93181000773252/_patchinfo @@ -0,0 +1,102 @@ + + + VUL-0: CVE-2026-26079: roundcubemail: Cascading Style Sheets (CSS) injection via mishandled comments + VUL-0: CVE-2026-25916: roundcubemail: remote image blocking bypass via SVG content + VUL-0: CVE-2025-68461: roundcubemail: crafted SVG animate tag can enable cross-site scripting (XSS) + VUL-0: CVE-2025-68460: roundcubemail: HTML style sanitizer can cause information disclosure + + + + abergmann + important + security + Security update for roundcubemail + This update for roundcubemail fixes the following issues: + +Changes to roundcubemail: + +Update to 1.6.13: + + This is a security update to the stable version 1.6 of Roundcube Webmail. + It provides fixes to recently reported security vulnerabilities: + + Fix CSS injection vulnerability reported by CERT Polska (boo#1258052, + CVE-2026-26079). + + Fix remote image blocking bypass via SVG content reported by nullcathedral + (boo#1257909, CVE-2026-25916). + + This version is considered stable and we recommend to update all productive + installations of Roundcube 1.6.x with it. Please do backup your data + before updating! + + CHANGELOG + + Managesieve: Fix handling of string-list format values for date + tests in Out of Office (#10075) + + Fix CSS injection vulnerability reported by CERT Polska. + + Fix remote image blocking bypass via SVG content reported by nullcathedral. + +Update to 1.6.12: + + This is a security update to the stable version 1.6 of Roundcube Webmail. + It provides fixes to recently reported security vulnerabilities: + + + Fix Cross-Site-Scripting vulnerability via SVG's animate tag + reported by Valentin T., CrowdStrike (boo#1255308, CVE-2025-68461). + + Fix Information Disclosure vulnerability in the HTML style + sanitizer reported by somerandomdev (boo#1255306, CVE-2025-68460). + + This version is considered stable and we recommend to update all + productive installations of Roundcube 1.6.x with it. + + + Support IPv6 in database DSN (#9937) + + Don't force specific error_reporting setting + + Fix compatibility with PHP 8.5 regarding array_first() + + Remove X-XSS-Protection example from .htaccess file (#9875) + + Fix "Assign to group" action state after creation of a first group (#9889) + + Fix bug where contacts search would fail if contactlist_fields contained vcard fields (#9850) + + Fix bug where an mbox export file could include inconsistent message delimiters (#9879) + + Fix parsing of inline styles that aren't well-formatted (#9948) + + Fix Cross-Site-Scripting vulnerability via SVG's animate tag + + Fix Information Disclosure vulnerability in the HTML style sanitizer + +Update to 1.6.11 + + This is a security update to the stable version 1.6 of Roundcube Webmail. + It provides fixes to recently reported security vulnerabilities: + * Fix Post-Auth RCE via PHP Object Deserialization reported by firs0v. + +- CHANGELOG + * Managesieve: Fix match-type selector (remove unsupported options) in delete header action (#9610) + * Improve installer to fix confusion about disabling SMTP authentication (#9801) + * Fix PHP warning in index.php (#9813) + * OAuth: Fix/improve token refresh + * Fix dark mode bug where wrong colors were used for blockquotes in HTML mail preview (#9820) + * Fix HTML message preview if it contains floating tables (#9804) + * Fix removing/expiring redis/memcache records when using a key prefix + * Fix bug where a wrong SPECIAL-USE folder could have been detected, if there were more than one per-type (#9781) + * Fix a default value and documentation of password_ldap_encodage option (#9658) + * Remove mobile/floating Create button from the list in Settings > Folders (#9661) + * Fix Delete and Empty buttons state while creating a folder (#9047) + * Fix connecting to LDAP using ldapi:// URI (#8990) + * Fix cursor position on "below the quote" reply in HTML mode (#8700) + * Fix bug where attachments with content type of application/vnd.ms-tnef were not parsed (#7119) + +Update to 1.6.10: + + This is the next service release to update the stable version 1.6. + * IMAP: Partial support for ANNOTATE-EXPERIMENT-1 extension (RFC 5257) + * OAuth: Support standard authentication with short-living password received with OIDC token (#9530) + * Fix PHP warnings (#9616, #9611) + * Fix whitespace handling in vCard line continuation (#9637) + * Fix current script state after initial scripts creation in managesieve_kolab_master mode + * Fix rcube_imap::get_vendor() result (and PHP warning) on Zimbra server (#9650) + * Fix regression causing inline SVG images to be missing in mail preview (#9644) + * Fix plugin "virtuser_file" to handle backward slashes in username (#9668) + * Fix PHP fatal error when parsing some malformed BODYSTRUCTURE responses (#9689) + * Fix insert_or_update() and reading database server config on PostgreSQL (#9710) + * Fix Oauth issues with use_secure_urls=true (#9722) + * Fix handling of binary mail parts (e.g. PDF) encoded with quoted-printable (#9728) + * Fix links in comments and config to https:// where available (#9759, #9756) + * Fix decoding of attachment names encoded using both RFC2231 and RFC2047 standards (#9725) + + roundcubemail + diff --git a/roundcubemail b/roundcubemail index 0ba59f2..b09e0f3 160000 --- a/roundcubemail +++ b/roundcubemail @@ -1 +1 @@ -Subproject commit 0ba59f25c7ec95da1170d036b2c8c25fabe15f49b6f812472c2a763950af7dcd +Subproject commit b09e0f3ab0cdeb0c1032eeb5d3581f04ac5f9ff70b75190909a593bdb4f3322e