Roundcube 1.6.10 → 1.6.15
5 releases · 1 breaking change · 18 security fixes · 0 advisories fixed
18security1breaking0deprecated0feature28fix
Breaking changes
- breaking Remove mobile/floating Create button from the list in Settings > Folders (#9661) in 1.6.11
Security changes
- security Fix IMAP Injection + CSRF bypass in mail search, reported by Martila Security Research Team. in 1.6.14
- security Fix XSS issue in a HTML attachment preview, reported by aikido_security. in 1.6.14
- security Fix SSRF + Information Disclosure via stylesheet links to a local network hosts, reported by Georgios Tsimpidas (aka Frey), Security Researcher at https://i0.rs/. in 1.6.14
- security Security: Fix pre-auth arbitrary file write via unsafe deserialization in redis/memcache session handler in 1.6.14
- security Security: Fix bug where a password could get changed without providing the old password in 1.6.14
- security Security: Fix IMAP Injection + CSRF bypass in mail search in 1.6.14
- security Security: Fix remote image blocking bypass via various SVG animate attributes in 1.6.14
- security Security: Fix remote image blocking bypass via a crafted body background attribute in 1.6.14
- security Security: Fix fixed position mitigation bypass via use of !important in 1.6.14
- security Security: Fix XSS issue in a HTML attachment preview in 1.6.14
- security Security: Fix SSRF + Information Disclosure via stylesheet links to a local network hosts in 1.6.14
- security Fix CSS injection vulnerability reported by CERT Polska. in 1.6.13
- security Fix Cross-Site-Scripting vulnerability via SVG's animate tag reported by Valentin T., CrowdStrike. in 1.6.12
- security Fix Information Disclosure vulnerability in the HTML style sanitizer reported by somerandomdev. in 1.6.12
- security Remove X-XSS-Protection example from .htaccess file (#9875) in 1.6.12
- security Fix Cross-Site-Scripting vulnerability via SVG's animate tag in 1.6.12
- security Fix Information Disclosure vulnerability in the HTML style sanitizer in 1.6.12
- security Fix Post-Auth RCE via PHP Object Deserialization reported by firs0v. in 1.6.11
Every release in between
otherSVG Animate FUNCIRI Attribute Bypass — Remote Image Loading via fill/filter/stroke, reported by class_nzm.
fixFix regression where mail search would fail on non-ascii search criteria (#10121)
fixFix regression where some data url images could get ignored/lost (#10128)
fixFix SVG Animate FUNCIRI Attribute Bypass — Remote Image Loading via fill/filter/stroke
fixFix pre-auth arbitrary file write via unsafe deserialization in redis/memcache session handler, reported by y0us.
fixFix bug where a password could get changed without providing the old password, reported by flydragon777.
securityFix IMAP Injection + CSRF bypass in mail search, reported by Martila Security Research Team.
fixFix remote image blocking bypass via various SVG animate attributes, reported by nullcathedral.
fixFix remote image blocking bypass via a crafted body background attribute, reported by nullcathedral.
fixFix fixed position mitigation bypass via use of !important, reported by nullcathedral.
securityFix XSS issue in a HTML attachment preview, reported by aikido_security.
securityFix SSRF + Information Disclosure via stylesheet links to a local network hosts, reported by Georgios Tsimpidas (aka Frey), Security Researcher at https://i0.rs/.
fixFix Postgres connection using IPv6 address (#10104)
securitySecurity: Fix pre-auth arbitrary file write via unsafe deserialization in redis/memcache session handler
securitySecurity: Fix bug where a password could get changed without providing the old password
securitySecurity: Fix IMAP Injection + CSRF bypass in mail search
securitySecurity: Fix remote image blocking bypass via various SVG animate attributes
securitySecurity: Fix remote image blocking bypass via a crafted body background attribute
securitySecurity: Fix fixed position mitigation bypass via use of !important
securitySecurity: Fix XSS issue in a HTML attachment preview
securitySecurity: Fix SSRF + Information Disclosure via stylesheet links to a local network hosts
securityFix CSS injection vulnerability reported by CERT Polska.
fixFix remote image blocking bypass via SVG content reported by nullcathedral.
fixManagesieve: Fix handling of string-list format values for date tests in Out of Office (#10075)
securityFix Cross-Site-Scripting vulnerability via SVG's animate tag reported by Valentin T., CrowdStrike.
securityFix Information Disclosure vulnerability in the HTML style sanitizer reported by somerandomdev.
otherSupport IPv6 in database DSN (#9937)
otherDon't force specific error_reporting setting
fixFix compatibility with PHP 8.5 regarding array_first()
securityRemove X-XSS-Protection example from .htaccess file (#9875)
fixFix "Assign to group" action state after creation of a first group (#9889)
fixFix bug where contacts search would fail if contactlist_fields contained vcard fields (#9850)
fixFix bug where an mbox export file could include inconsistent message delimiters (#9879)
fixFix parsing of inline styles that aren't well-formatted (#9948)
securityFix Cross-Site-Scripting vulnerability via SVG's animate tag
securityFix Information Disclosure vulnerability in the HTML style sanitizer
securityFix Post-Auth RCE via PHP Object Deserialization reported by firs0v.
fixManagesieve: Fix match-type selector (remove unsupported options) in delete header action (#9610)
otherImprove installer to fix confusion about disabling SMTP authentication (#9801)
fixFix PHP warning in index.php (#9813)
fixOAuth: Fix/improve token refresh
fixFix dark mode bug where wrong colors were used for blockquotes in HTML mail preview (#9820)
fixFix HTML message preview if it contains floating tables (#9804)
fixFix removing/expiring redis/memcache records when using a key prefix
fixFix bug where a wrong SPECIAL-USE folder could have been detected, if there were more than one per-type (#9781)
fixFix a default value and documentation of password_ldap_encodage option (#9658)
breakingRemove mobile/floating Create button from the list in Settings > Folders (#9661)
fixFix Delete and Empty buttons state while creating a folder (#9047)
fixFix connecting to LDAP using ldapi:// URI (#8990)
fixFix cursor position on "below the quote" reply in HTML mode (#8700)
fixFix bug where attachments with content type of application/vnd.ms-tnef were not parsed (#7119)