rpm/roundcubemail
SHA256
1
0
Fork 0
forked from pool/roundcubemail
Code Pull Requests Activity

Accepting request 1175253 from home:lrupp:branches:server:php:applications

Browse Source 
- update to 1.6.7
  This is a security update to the stable version 1.6 of Roundcube Webmail.
  It provides a fix to a recently reported XSS vulnerabilities:
  * Fix cross-site scripting (XSS) vulnerability in handling SVG animate attributes.
    Reported by Valentin T. and Lutz Wolf of CrowdStrike.
  * Fix cross-site scripting (XSS) vulnerability in handling list columns from user preferences.
    Reported by Huy Nguyễn Phạm Nhật.
  * Fix command injection via crafted im_convert_path/im_identify_path on Windows.
    Reported by Huy Nguyễn Phạm Nhật.
  CHANGELOG
  * Makefile: Use phpDocumentor v3.4 for the Framework docs (#9313)
  * Fix bug where HTML entities in URLs were not decoded on HTML to plain text conversion (#9312)
  * Fix bug in collapsing/expanding folders with some special characters in names (#9324)
  * Fix PHP8 warnings (#9363, #9365, #9429)
  * Fix missing field labels in CSV import, for some locales (#9393)
  * Fix cross-site scripting (XSS) vulnerability in handling SVG animate attributes
  * Fix cross-site scripting (XSS) vulnerability in handling list columns from user preferences
  * Fix command injection via crafted im_convert_path/im_identify_path on Windows

OBS-URL: https://build.opensuse.org/request/show/1175253
OBS-URL: https://build.opensuse.org/package/show/server:php:applications/roundcubemail?expand=0&rev=173
This commit is contained in:
Lars Vogdt 2024-05-19 17:47:04 +00:00 committed by Git OBS Bridge
parent 45a459b079
commit aaea9d8cf8
6 changed files with 42 additions and 20 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
roundcubemail-1.6.6-complete.tar.gz
View File

@ -1,3 +0,0 @@
version https://git-lfs.github.com/spec/v1
oid sha256:c1b93a3edbe297457396b0a031d8b13c8a5dc30c9370704dfb9b2c1225017d52
size 5895753

16
roundcubemail-1.6.6-complete.tar.gz.asc
View File

@ -1,16 +0,0 @@
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEiXDjemmK93XYfVkNwpRqlgnNVrQFAmWrn64ACgkQwpRqlgnN
VrQb3Q/+MsO0rPJXOE04LIKtsxj9Bfh/avFSasKmX9+c5MdjABV7mHR0hoqbkGR8
kqf7LtUyFQrQ/QXWV09hCdGY8I8IwoRIqMkmc/VA56/DZ+SrEe69wGCdzd3ruMQJ
XNK7RrcWthxPEro+pHuCGvZ4AyvUDDnO08W5juxRFoepoW2fPqfbPZfvsAoea8Ep
Sh+4PGWHNyyybH/0U4NtPHRPuprwUqBo0uZlp7CTUCN6vR3Mlqt3Ivgj8T+FtoIV
t8CXUtVCSRmC5tFppdE9icGoA+hFWpKuFzz4qv6fVwD+yQ7aFYBidWHPNBl0kEh+
IwB7AvoxPpFkNwT6ai3462Pfe5aJyhszkVvs4+Zrnb3+ZbmFrYKt0CgZvlAAR76e
bEoU+cWKJX0kME3ZUe6Ee5N6NK+S8M6DYLJ/xWyywU9aMlpmq1hcHXbLjUB/GZWJ
rTNP7V20pULgP0iK1iuApvWW/ogCNsDuORXM36cVLWG+5tzgYA9vcBY7dr10s+au
P8yagXJomhTq/VyIeyrCAWQZjXrRCndc+1ZkL81JwqTbqMCNdzPkIs+p2Mnujy05
3bhNkJTWrdoyHPCK03iJT6IY+WOZBfs6GGf/H1L9ai9m72yg276OZ0Jeg6MMH5CQ
oq/QD4pLjF09hieWNW61d+ubBYOiZAwyDsQBTHWcKI8c6ISCSd0=
=cl9d
-----END PGP SIGNATURE-----

3
roundcubemail-1.6.7-complete.tar.gz Normal file
View File

@ -0,0 +1,3 @@
version https://git-lfs.github.com/spec/v1
oid sha256:cf52515e65b2818cb02fd7a202c766367b8c54d8b7fea27dda9c81aa7ce1d3a6
size 5899345

16
roundcubemail-1.6.7-complete.tar.gz.asc Normal file
View File

@ -0,0 +1,16 @@
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEiXDjemmK93XYfVkNwpRqlgnNVrQFAmZJ0UIACgkQwpRqlgnN
VrRndRAAicU/OXjddhgBxfUn2OwfuQCVgC3lj8dvquVkdYfGMUieoxaGiJuzUO+2
K6Ohm+ztsosGDG5qb8stI1wki00dFZ8vNQ4rmZOXy4fv94zT5Ytm4kUojUVfvERr
Ksd/LHEnbNxIQNnBcD5aUrkVv9OxD4lnwYkBkt4vA2G7IDNDC9raDWLcJTZSUvQb
juQ7HIvUp5tzQ0Y9coMhB52jpVJYLZlCdNLvd9zGTebwO/TBBAPLasLusVacQN4W
Sp33RSS/VMQjx1rnmvnltu+0TKXFUYL620Mn6woEhiF/ahXYgcRqz2im2520YNIK
mpz6laU6kc4bNTD6ynQtZ+ZWorC+NrENMhh+T8oX7BPqBKK6T/fuLSiGJfNecaUH
TfH2O9DIiZZ0AP8sAz+Dcjz21sm0Sh2iRSntycbIrhON5nvV/mVDXxOjZ0ZbS3wm
fs8JRvMOk5tXcH4u8y6Z66z19JGjcXnp6FpTfn0mjfy7HcMGN/6OaykVDDQbng7q
Z9DLXlXjN1dNiLELPVQAfUZNy/KbUPy4GI7uifcCGIcx4V1kW2XDGe8tzDMwNUhS
ToS8r0F2VnYcfu+dPXZ2OOWxf+ZT1Mp5shzbCK+ZWWn2/e8t2h2pRFCMgVOmJrWd
yRpNS/zoDjcGp6eLBWragpA2fhOPNktXMH4r2iYfhQkkk+qIrr4=
=s8Ri
-----END PGP SIGNATURE-----

22
roundcubemail.changes
View File

@ -1,3 +1,25 @@
-------------------------------------------------------------------
Sun May 19 17:12:36 UTC 2024 - Lars Vogdt <lars@linux-schulserver.de>
- update to 1.6.7
This is a security update to the stable version 1.6 of Roundcube Webmail.
It provides a fix to a recently reported XSS vulnerabilities:
* Fix cross-site scripting (XSS) vulnerability in handling SVG animate attributes.
Reported by Valentin T. and Lutz Wolf of CrowdStrike.
* Fix cross-site scripting (XSS) vulnerability in handling list columns from user preferences.
Reported by Huy Nguyễn Phạm Nhật.
* Fix command injection via crafted im_convert_path/im_identify_path on Windows.
Reported by Huy Nguyễn Phạm Nhật.
CHANGELOG
* Makefile: Use phpDocumentor v3.4 for the Framework docs (#9313)
* Fix bug where HTML entities in URLs were not decoded on HTML to plain text conversion (#9312)
* Fix bug in collapsing/expanding folders with some special characters in names (#9324)
* Fix PHP8 warnings (#9363, #9365, #9429)
* Fix missing field labels in CSV import, for some locales (#9393)
* Fix cross-site scripting (XSS) vulnerability in handling SVG animate attributes
* Fix cross-site scripting (XSS) vulnerability in handling list columns from user preferences
* Fix command injection via crafted im_convert_path/im_identify_path on Windows
-------------------------------------------------------------------
Fri Feb 23 11:43:56 UTC 2024 - Dominique Leuenberger <dimstar@opensuse.org>

2
roundcubemail.spec
View File

@ -20,7 +20,7 @@
%define roundcubeconfigpath %{_sysconfdir}/%{name}
Name: roundcubemail
Version: 1.6.6
Version: 1.6.7
Release: 0
Summary: A browser-based multilingual IMAP client
License: BSD-3-Clause AND GPL-2.0-only AND GPL-3.0-or-later