Accepting request 1175253 from home:lrupp:branches:server:php:applications

- update to 1.6.7
  This is a security update to the stable version 1.6 of Roundcube Webmail.
  It provides a fix to a recently reported XSS vulnerabilities:
  * Fix cross-site scripting (XSS) vulnerability in handling SVG animate attributes.
    Reported by Valentin T. and Lutz Wolf of CrowdStrike.
  * Fix cross-site scripting (XSS) vulnerability in handling list columns from user preferences.
    Reported by Huy Nguyễn Phạm Nhật.
  * Fix command injection via crafted im_convert_path/im_identify_path on Windows.
    Reported by Huy Nguyễn Phạm Nhật.
  CHANGELOG
  * Makefile: Use phpDocumentor v3.4 for the Framework docs (#9313)
  * Fix bug where HTML entities in URLs were not decoded on HTML to plain text conversion (#9312)
  * Fix bug in collapsing/expanding folders with some special characters in names (#9324)
  * Fix PHP8 warnings (#9363, #9365, #9429)
  * Fix missing field labels in CSV import, for some locales (#9393)
  * Fix cross-site scripting (XSS) vulnerability in handling SVG animate attributes
  * Fix cross-site scripting (XSS) vulnerability in handling list columns from user preferences
  * Fix command injection via crafted im_convert_path/im_identify_path on Windows

OBS-URL: https://build.opensuse.org/request/show/1175253
OBS-URL: https://build.opensuse.org/package/show/server:php:applications/roundcubemail?expand=0&rev=173

roundcubemail-1.6.6-complete.tar.gz

@@ -1,3 +0,0 @@
-version https://git-lfs.github.com/spec/v1
-oid sha256:c1b93a3edbe297457396b0a031d8b13c8a5dc30c9370704dfb9b2c1225017d52
-size 5895753

roundcubemail-1.6.6-complete.tar.gz.asc

@@ -1,16 +0,0 @@
------BEGIN PGP SIGNATURE-----
-
-iQIzBAABCgAdFiEEiXDjemmK93XYfVkNwpRqlgnNVrQFAmWrn64ACgkQwpRqlgnN
-VrQb3Q/+MsO0rPJXOE04LIKtsxj9Bfh/avFSasKmX9+c5MdjABV7mHR0hoqbkGR8
-kqf7LtUyFQrQ/QXWV09hCdGY8I8IwoRIqMkmc/VA56/DZ+SrEe69wGCdzd3ruMQJ
-XNK7RrcWthxPEro+pHuCGvZ4AyvUDDnO08W5juxRFoepoW2fPqfbPZfvsAoea8Ep
-Sh+4PGWHNyyybH/0U4NtPHRPuprwUqBo0uZlp7CTUCN6vR3Mlqt3Ivgj8T+FtoIV
-t8CXUtVCSRmC5tFppdE9icGoA+hFWpKuFzz4qv6fVwD+yQ7aFYBidWHPNBl0kEh+
-IwB7AvoxPpFkNwT6ai3462Pfe5aJyhszkVvs4+Zrnb3+ZbmFrYKt0CgZvlAAR76e
-bEoU+cWKJX0kME3ZUe6Ee5N6NK+S8M6DYLJ/xWyywU9aMlpmq1hcHXbLjUB/GZWJ
-rTNP7V20pULgP0iK1iuApvWW/ogCNsDuORXM36cVLWG+5tzgYA9vcBY7dr10s+au
-P8yagXJomhTq/VyIeyrCAWQZjXrRCndc+1ZkL81JwqTbqMCNdzPkIs+p2Mnujy05
-3bhNkJTWrdoyHPCK03iJT6IY+WOZBfs6GGf/H1L9ai9m72yg276OZ0Jeg6MMH5CQ
-oq/QD4pLjF09hieWNW61d+ubBYOiZAwyDsQBTHWcKI8c6ISCSd0=
-=cl9d
------END PGP SIGNATURE-----

roundcubemail-1.6.7-complete.tar.gz

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:cf52515e65b2818cb02fd7a202c766367b8c54d8b7fea27dda9c81aa7ce1d3a6
+size 5899345

roundcubemail-1.6.7-complete.tar.gz.asc

@@ -0,0 +1,16 @@
+-----BEGIN PGP SIGNATURE-----
+
+iQIzBAABCgAdFiEEiXDjemmK93XYfVkNwpRqlgnNVrQFAmZJ0UIACgkQwpRqlgnN
+VrRndRAAicU/OXjddhgBxfUn2OwfuQCVgC3lj8dvquVkdYfGMUieoxaGiJuzUO+2
+K6Ohm+ztsosGDG5qb8stI1wki00dFZ8vNQ4rmZOXy4fv94zT5Ytm4kUojUVfvERr
+Ksd/LHEnbNxIQNnBcD5aUrkVv9OxD4lnwYkBkt4vA2G7IDNDC9raDWLcJTZSUvQb
+juQ7HIvUp5tzQ0Y9coMhB52jpVJYLZlCdNLvd9zGTebwO/TBBAPLasLusVacQN4W
+Sp33RSS/VMQjx1rnmvnltu+0TKXFUYL620Mn6woEhiF/ahXYgcRqz2im2520YNIK
+mpz6laU6kc4bNTD6ynQtZ+ZWorC+NrENMhh+T8oX7BPqBKK6T/fuLSiGJfNecaUH
+TfH2O9DIiZZ0AP8sAz+Dcjz21sm0Sh2iRSntycbIrhON5nvV/mVDXxOjZ0ZbS3wm
+fs8JRvMOk5tXcH4u8y6Z66z19JGjcXnp6FpTfn0mjfy7HcMGN/6OaykVDDQbng7q
+Z9DLXlXjN1dNiLELPVQAfUZNy/KbUPy4GI7uifcCGIcx4V1kW2XDGe8tzDMwNUhS
+ToS8r0F2VnYcfu+dPXZ2OOWxf+ZT1Mp5shzbCK+ZWWn2/e8t2h2pRFCMgVOmJrWd
+yRpNS/zoDjcGp6eLBWragpA2fhOPNktXMH4r2iYfhQkkk+qIrr4=
+=s8Ri
+-----END PGP SIGNATURE-----

roundcubemail.changes

@@ -1,3 +1,25 @@
+-------------------------------------------------------------------
+Sun May 19 17:12:36 UTC 2024 - Lars Vogdt <lars@linux-schulserver.de>
+
+- update to 1.6.7
+  This is a security update to the stable version 1.6 of Roundcube Webmail.
+  It provides a fix to a recently reported XSS vulnerabilities:
+  * Fix cross-site scripting (XSS) vulnerability in handling SVG animate attributes.
+    Reported by Valentin T. and Lutz Wolf of CrowdStrike.
+  * Fix cross-site scripting (XSS) vulnerability in handling list columns from user preferences.
+    Reported by Huy Nguyễn Phạm Nhật.
+  * Fix command injection via crafted im_convert_path/im_identify_path on Windows.
+    Reported by Huy Nguyễn Phạm Nhật.
+  CHANGELOG
+  * Makefile: Use phpDocumentor v3.4 for the Framework docs (#9313)
+  * Fix bug where HTML entities in URLs were not decoded on HTML to plain text conversion (#9312)
+  * Fix bug in collapsing/expanding folders with some special characters in names (#9324)
+  * Fix PHP8 warnings (#9363, #9365, #9429)
+  * Fix missing field labels in CSV import, for some locales (#9393)
+  * Fix cross-site scripting (XSS) vulnerability in handling SVG animate attributes
+  * Fix cross-site scripting (XSS) vulnerability in handling list columns from user preferences
+  * Fix command injection via crafted im_convert_path/im_identify_path on Windows
+
 -------------------------------------------------------------------
 Fri Feb 23 11:43:56 UTC 2024 - Dominique Leuenberger <dimstar@opensuse.org>
 

roundcubemail.spec

@@ -20,7 +20,7 @@
 %define roundcubeconfigpath %{_sysconfdir}/%{name}
 
 Name:           roundcubemail
-Version:        1.6.6
+Version:        1.6.7
 Release:        0
 Summary:        A browser-based multilingual IMAP client
 License:        BSD-3-Clause AND GPL-2.0-only AND GPL-3.0-or-later