roundcubemail/roundcubemail-1.6.7-complete.tar.gz at aaea9d8cf8685976758c4d5ae36d216729f6365cb4918f813984158758a6e36f - roundcubemail - openSUSE Gitea

rpm/roundcubemail

SHA256

forked from pool/roundcubemail

Lars Vogdt aaea9d8cf8 Accepting request 1175253 from home:lrupp:branches:server:php:applications

- update to 1.6.7
  This is a security update to the stable version 1.6 of Roundcube Webmail.
  It provides a fix to a recently reported XSS vulnerabilities:
  * Fix cross-site scripting (XSS) vulnerability in handling SVG animate attributes.
    Reported by Valentin T. and Lutz Wolf of CrowdStrike.
  * Fix cross-site scripting (XSS) vulnerability in handling list columns from user preferences.
    Reported by Huy Nguyễn Phạm Nhật.
  * Fix command injection via crafted im_convert_path/im_identify_path on Windows.
    Reported by Huy Nguyễn Phạm Nhật.
  CHANGELOG
  * Makefile: Use phpDocumentor v3.4 for the Framework docs (#9313)
  * Fix bug where HTML entities in URLs were not decoded on HTML to plain text conversion (#9312)
  * Fix bug in collapsing/expanding folders with some special characters in names (#9324)
  * Fix PHP8 warnings (#9363, #9365, #9429)
  * Fix missing field labels in CSV import, for some locales (#9393)
  * Fix cross-site scripting (XSS) vulnerability in handling SVG animate attributes
  * Fix cross-site scripting (XSS) vulnerability in handling list columns from user preferences
  * Fix command injection via crafted im_convert_path/im_identify_path on Windows

OBS-URL: https://build.opensuse.org/request/show/1175253
OBS-URL: https://build.opensuse.org/package/show/server:php:applications/roundcubemail?expand=0&rev=173

2024-05-19 17:47:04 +00:00

4 lines

132 B

Plaintext

Raw Blame History

	`version https://git-lfs.github.com/spec/v1`
	`oid sha256:cf52515e65b2818cb02fd7a202c766367b8c54d8b7fea27dda9c81aa7ce1d3a6`
	`size 5899345`