Roundcube 1.6.18 → 1.6.19
1 release · 0 breaking changes · 15 security fixes · 0 advisories fixed
15security0breaking0deprecated0feature10fix
Breaking changes
None in the release notes.
Security changes
- security Fix zero-click stored XSS via TNEF MIME tag injection in the attachment URL, reported by nakko in 1.6.19
- security Fix XSS in the HTML editor using text/enriched part content, reported by Joshua Rogers in 1.6.19
- security Fix SSRF bypass in Roundcube CSS proxy via hexadecimal IPv6-mapped IPv4 addresses, reported by faceless0x7 and Harish Annavisamy in 1.6.19
- security Security: Fix CSS declaration smuggling via un-encoded ampersand emission in 1.6.19
- security Security: Fix CSS property injection via body background attribute in 1.6.19
- security Security: Fix email header injection via bare CR in the subject field in 1.6.19
- security Security: Fix email header injection via C-escape \r in the recipient display name in 1.6.19
- security Security: Fix email header injection via identity's organization field in 1.6.19
- security Security: Fix zero-click stored XSS via TNEF MIME tag injection in the attachment URL in 1.6.19
- security Security: Fix XSS in the HTML editor using text/enriched part content in 1.6.19
- security Security: Fix cross-user access in contact group membership (add/remove) in the SQL address book in 1.6.19
- security Security: Fix is_local_url() bypass via trailing-dot FQDN in stylesheet URL in 1.6.19
- security Security: Fix remote content blocking bypass via CSS escapes in FuncIRI attributes in 1.6.19
- security Security: Fix remote-content blocker bypass via SVG SMIL src animation in 1.6.19
- security Security: Fix SSRF bypass in Roundcube CSS proxy via hexadecimal IPv6-mapped IPv4 addresses in 1.6.19
Every release in between
fixFix CSS declaration smuggling via un-encoded ampersand emission, reported by Zach Hanley of Horizon3.ai
fixFix CSS property injection via body background attribute, reported by zenithhostingevan
fixFix email header injection via bare CR in the subject field, reported by CVE-Hunter-Leo
fixFix email header injection via C-escape \r in the recipient display name, reported by dogeshark
fixFix email header injection via identity's organization field, reported by dogeshark
securityFix zero-click stored XSS via TNEF MIME tag injection in the attachment URL, reported by nakko
securityFix XSS in the HTML editor using text/enriched part content, reported by Joshua Rogers
fixFix cross-user access in contact group membership (add/remove) in the SQL address book, reported by Joshua Rogers
fixFix is_local_url() bypass via trailing-dot FQDN in stylesheet URL, reported by nept1337
fixFix remote content blocking bypass via CSS escapes in FuncIRI attributes, reported by neoxed
fixFix remote-content blocker bypass via SVG SMIL src animation
securityFix SSRF bypass in Roundcube CSS proxy via hexadecimal IPv6-mapped IPv4 addresses, reported by faceless0x7 and Harish Annavisamy
fixFix PHP Warning: Undefined variable $tmp_command in .../plugins/markasjunk/drivers/cmd_learn.php (#10294)
securitySecurity: Fix CSS declaration smuggling via un-encoded ampersand emission
securitySecurity: Fix CSS property injection via body background attribute
securitySecurity: Fix email header injection via bare CR in the subject field
securitySecurity: Fix email header injection via C-escape \r in the recipient display name
securitySecurity: Fix email header injection via identity's organization field
securitySecurity: Fix zero-click stored XSS via TNEF MIME tag injection in the attachment URL
securitySecurity: Fix XSS in the HTML editor using text/enriched part content
securitySecurity: Fix cross-user access in contact group membership (add/remove) in the SQL address book
securitySecurity: Fix is_local_url() bypass via trailing-dot FQDN in stylesheet URL
securitySecurity: Fix remote content blocking bypass via CSS escapes in FuncIRI attributes
securitySecurity: Fix remote-content blocker bypass via SVG SMIL src animation
securitySecurity: Fix SSRF bypass in Roundcube CSS proxy via hexadecimal IPv6-mapped IPv4 addresses