From 181a7d6c6da9984171b10c9fc794ff2b1f783b18514ca108002f8a07c05f3700 Mon Sep 17 00:00:00 2001 From: Robert Frohl Date: Wed, 4 Mar 2026 21:07:59 +0100 Subject: [PATCH 1/4] Update submodules from pool/roundcubemail#2 and create patchinfo.20260304200727360655.93181000773252/_patchinfo --- .../_patchinfo | 98 +++++++++++++++++++ roundcubemail | 2 +- 2 files changed, 99 insertions(+), 1 deletion(-) create mode 100644 patchinfo.20260304200727360655.93181000773252/_patchinfo diff --git a/patchinfo.20260304200727360655.93181000773252/_patchinfo b/patchinfo.20260304200727360655.93181000773252/_patchinfo new file mode 100644 index 0000000..472c84b --- /dev/null +++ b/patchinfo.20260304200727360655.93181000773252/_patchinfo @@ -0,0 +1,98 @@ + + + VUL-0: CVE-2026-26079: roundcubemail: Cascading Style Sheets (CSS) injection via mishandled comments + VUL-0: CVE-2026-25916: roundcubemail: remote image blocking bypass via SVG content + VUL-0: CVE-2025-68461: roundcubemail: crafted SVG animate tag can enable cross-site scripting (XSS) + VUL-0: CVE-2025-68460: roundcubemail: HTML style sanitizer can cause information disclosure + + + + abergmann + important + security + Security update for roundcubemail + This update for roundcubemail fixes the following issues: + +Changes in roundcubemail: + +- update to 1.6.13 + This is a security update to the stable version 1.6 of Roundcube Webmail. + It provides fixes to recently reported security vulnerabilities: + + Fix CSS injection vulnerability reported by CERT Polska (boo#1258052, + CVE-2026-26079). + + Fix remote image blocking bypass via SVG content reported by nullcathedral + (boo#1257909, CVE-2026-25916). + + This version is considered stable and we recommend to update all productive + installations of Roundcube 1.6.x with it. Please do backup your data + before updating! + + CHANGELOG + + Managesieve: Fix handling of string-list format values for date + tests in Out of Office (#10075) + + Fix CSS injection vulnerability reported by CERT Polska. + + Fix remote image blocking bypass via SVG content reported by nullcathedral. + +- update to 1.6.12 + This is a security update to the stable version 1.6 of Roundcube Webmail. + It provides fixes to recently reported security vulnerabilities: + + + Fix Cross-Site-Scripting vulnerability via SVG's animate tag + reported by Valentin T., CrowdStrike (boo#1255308, CVE-2025-68461). + + Fix Information Disclosure vulnerability in the HTML style + sanitizer reported by somerandomdev (boo#1255306, CVE-2025-68460). + + This version is considered stable and we recommend to update all + productive installations of Roundcube 1.6.x with it. + + + Support IPv6 in database DSN (#9937) + + Don't force specific error_reporting setting + + Fix compatibility with PHP 8.5 regarding array_first() + + Remove X-XSS-Protection example from .htaccess file (#9875) + + Fix "Assign to group" action state after creation of a first group (#9889) + + Fix bug where contacts search would fail if contactlist_fields contained vcard fields (#9850) + + Fix bug where an mbox export file could include inconsistent message delimiters (#9879) + + Fix parsing of inline styles that aren't well-formatted (#9948) + + Fix Cross-Site-Scripting vulnerability via SVG's animate tag + + Fix Information Disclosure vulnerability in the HTML style sanitizer + +- update to 1.6.11 + This is a security update to the stable version 1.6 of Roundcube Webmail. + It provides fixes to recently reported security vulnerabilities: + * Fix Post-Auth RCE via PHP Object Deserialization reported by firs0v. + +- CHANGELOG + * Managesieve: Fix match-type selector (remove unsupported options) in delete header action (#9610) + * Improve installer to fix confusion about disabling SMTP authentication (#9801) + * Fix PHP warning in index.php (#9813) + * OAuth: Fix/improve token refresh + * Fix dark mode bug where wrong colors were used for blockquotes in HTML mail preview (#9820) + * Fix HTML message preview if it contains floating tables (#9804) + * Fix removing/expiring redis/memcache records when using a key prefix + * Fix bug where a wrong SPECIAL-USE folder could have been detected, if there were more than one per-type (#9781) + * Fix a default value and documentation of password_ldap_encodage option (#9658) + * Remove mobile/floating Create button from the list in Settings > Folders (#9661) + * Fix Delete and Empty buttons state while creating a folder (#9047) + * Fix connecting to LDAP using ldapi:// URI (#8990) + * Fix cursor position on "below the quote" reply in HTML mode (#8700) + * Fix bug where attachments with content type of application/vnd.ms-tnef were not parsed (#7119) + +- update to 1.6.10 + This is the next service release to update the stable version 1.6. + * IMAP: Partial support for ANNOTATE-EXPERIMENT-1 extension (RFC 5257) + * OAuth: Support standard authentication with short-living password received with OIDC token (#9530) + * Fix PHP warnings (#9616, #9611) + * Fix whitespace handling in vCard line continuation (#9637) + * Fix current script state after initial scripts creation in managesieve_kolab_master mode + * Fix rcube_imap::get_vendor() result (and PHP warning) on Zimbra server (#9650) + * Fix regression causing inline SVG images to be missing in mail preview (#9644) + * Fix plugin "virtuser_file" to handle backward slashes in username (#9668) + * Fix PHP fatal error when parsing some malformed BODYSTRUCTURE responses (#9689) + * Fix insert_or_update() and reading database server config on PostgreSQL (#9710) + * Fix Oauth issues with use_secure_urls=true (#9722) + * Fix handling of binary mail parts (e.g. PDF) encoded with quoted-printable (#9728) + * Fix links in comments and config to https:// where available (#9759, #9756) + * Fix decoding of attachment names encoded using both RFC2231 and RFC2047 standards (#9725) + + roundcubemail + diff --git a/roundcubemail b/roundcubemail index 0ba59f2..a41af63 160000 --- a/roundcubemail +++ b/roundcubemail @@ -1 +1 @@ -Subproject commit 0ba59f25c7ec95da1170d036b2c8c25fabe15f49b6f812472c2a763950af7dcd +Subproject commit a41af63c66bb8b930e33352ae4e31c781c9e70f664073520e0bc0b52e1cefbc5 -- 2.51.1 From 7e6ac3f6ee54f47a013066c9157071ea99e719f2ae67cc1fd4109185ced8410d Mon Sep 17 00:00:00 2001 From: Robert Frohl Date: Thu, 5 Mar 2026 11:26:18 +0100 Subject: [PATCH 2/4] Update patchinfo.20260304200727360655.93181000773252/_patchinfo formating --- patchinfo.20260304200727360655.93181000773252/_patchinfo | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/patchinfo.20260304200727360655.93181000773252/_patchinfo b/patchinfo.20260304200727360655.93181000773252/_patchinfo index 472c84b..84ea59a 100644 --- a/patchinfo.20260304200727360655.93181000773252/_patchinfo +++ b/patchinfo.20260304200727360655.93181000773252/_patchinfo @@ -13,7 +13,7 @@ Security update for roundcubemail This update for roundcubemail fixes the following issues: -Changes in roundcubemail: +Updating roundcubemail to 1.6.13: - update to 1.6.13 This is a security update to the stable version 1.6 of Roundcube Webmail. -- 2.51.1 From 50e88b270665273b1e479c628989f78bf8921b81f567572cf0c104d77c730a1f Mon Sep 17 00:00:00 2001 From: Robert Frohl Date: Thu, 5 Mar 2026 11:33:57 +0100 Subject: [PATCH 3/4] Update patchinfo.20260304200727360655.93181000773252/_patchinfo another try --- .../_patchinfo | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-) diff --git a/patchinfo.20260304200727360655.93181000773252/_patchinfo b/patchinfo.20260304200727360655.93181000773252/_patchinfo index 84ea59a..cc62506 100644 --- a/patchinfo.20260304200727360655.93181000773252/_patchinfo +++ b/patchinfo.20260304200727360655.93181000773252/_patchinfo @@ -13,9 +13,10 @@ Security update for roundcubemail This update for roundcubemail fixes the following issues: -Updating roundcubemail to 1.6.13: +Changes to roundcubemail: + +Update to 1.6.13: -- update to 1.6.13 This is a security update to the stable version 1.6 of Roundcube Webmail. It provides fixes to recently reported security vulnerabilities: + Fix CSS injection vulnerability reported by CERT Polska (boo#1258052, @@ -33,7 +34,8 @@ Updating roundcubemail to 1.6.13: + Fix CSS injection vulnerability reported by CERT Polska. + Fix remote image blocking bypass via SVG content reported by nullcathedral. -- update to 1.6.12 +Update to 1.6.12: + This is a security update to the stable version 1.6 of Roundcube Webmail. It provides fixes to recently reported security vulnerabilities: @@ -56,7 +58,8 @@ Updating roundcubemail to 1.6.13: + Fix Cross-Site-Scripting vulnerability via SVG's animate tag + Fix Information Disclosure vulnerability in the HTML style sanitizer -- update to 1.6.11 +Update to 1.6.11 + This is a security update to the stable version 1.6 of Roundcube Webmail. It provides fixes to recently reported security vulnerabilities: * Fix Post-Auth RCE via PHP Object Deserialization reported by firs0v. @@ -77,7 +80,8 @@ Updating roundcubemail to 1.6.13: * Fix cursor position on "below the quote" reply in HTML mode (#8700) * Fix bug where attachments with content type of application/vnd.ms-tnef were not parsed (#7119) -- update to 1.6.10 +Update to 1.6.10: + This is the next service release to update the stable version 1.6. * IMAP: Partial support for ANNOTATE-EXPERIMENT-1 extension (RFC 5257) * OAuth: Support standard authentication with short-living password received with OIDC token (#9530) -- 2.51.1 From 4f61c0d3cdf6785e4b18330cc86a4d7c5f9fed8df7c45371c79f9178967ac8f1 Mon Sep 17 00:00:00 2001 From: AutoGits PR Review Bot Date: Thu, 5 Mar 2026 14:43:57 +0000 Subject: [PATCH 4/4] auto-created for roundcubemail This commit was autocreated by AutoGits PR Review Bot referencing PRs: PR: pool/roundcubemail!2 --- roundcubemail | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/roundcubemail b/roundcubemail index a41af63..b09e0f3 160000 --- a/roundcubemail +++ b/roundcubemail @@ -1 +1 @@ -Subproject commit a41af63c66bb8b930e33352ae4e31c781c9e70f664073520e0bc0b52e1cefbc5 +Subproject commit b09e0f3ab0cdeb0c1032eeb5d3581f04ac5f9ff70b75190909a593bdb4f3322e -- 2.51.1