Roundcube 1.6.4 → 1.6.16
12 releases · 2 breaking changes · 41 security fixes · 0 advisories fixed
41security2breaking0deprecated1feature78fix
Breaking changes
- breaking Remove mobile/floating Create button from the list in Settings > Folders (#9661) in 1.6.11
- breaking Fix bug where trailing non-ascii characters in email addresses could have been removed in recipient input (#9257) in 1.6.6
Security changes
- security Fix stored XSS/HTML/CSS injection in subject field of the draft restore dialog, reported by Anand Jogawade (zazy) in 1.6.16
- security Fix pre-auth SQL injection in virtuser_query plugin via preg_replace backslash escape bypass, reported by skull in 1.6.16
- security Fix SSRF bypass via specific local address URLs in 1.6.16
- security Fix local/private URL fetch bypass when remote resources were not allowed, reported by Orange Cyberdefense Vulnerability Disclosure Team in 1.6.16
- security Fix code injection vulnerability - remove support for code evaluation in LDAP autovalues option, reported by Glendaenri in 1.6.16
- security Security: Fix stored XSS/HTML/CSS injection in subject field of the draft restore dialog in 1.6.16
- security Security: Fix CSS injection bypass in HTML sanitizer via SVG in 1.6.16
- security Security: Fix pre-auth SQL injection in virtuser_query plugin via preg_replace backslash escape bypass in 1.6.16
- security Security: Fix SSRF bypass via specific local address URLs in 1.6.16
- security Security: Fix bypass of remote image blocking via CSS var() in 1.6.16
- security Security: Fix local/private URL fetch bypass when remote resources were not allowed in 1.6.16
- security Security: Fix pre-auth arbitrary file delete via redis/memcache session poisoning bypass in 1.6.16
- security Security: Fix code injection vulnerability - remove support for code evaluation in LDAP autovalues option in 1.6.16
- security Fix IMAP Injection + CSRF bypass in mail search, reported by Martila Security Research Team. in 1.6.14
- security Fix XSS issue in a HTML attachment preview, reported by aikido_security. in 1.6.14
- security Fix SSRF + Information Disclosure via stylesheet links to a local network hosts, reported by Georgios Tsimpidas (aka Frey), Security Researcher at https://i0.rs/. in 1.6.14
- security Security: Fix pre-auth arbitrary file write via unsafe deserialization in redis/memcache session handler in 1.6.14
- security Security: Fix bug where a password could get changed without providing the old password in 1.6.14
- security Security: Fix IMAP Injection + CSRF bypass in mail search in 1.6.14
- security Security: Fix remote image blocking bypass via various SVG animate attributes in 1.6.14
- security Security: Fix remote image blocking bypass via a crafted body background attribute in 1.6.14
- security Security: Fix fixed position mitigation bypass via use of !important in 1.6.14
- security Security: Fix XSS issue in a HTML attachment preview in 1.6.14
- security Security: Fix SSRF + Information Disclosure via stylesheet links to a local network hosts in 1.6.14
- security Fix CSS injection vulnerability reported by CERT Polska. in 1.6.13
- security Fix Cross-Site-Scripting vulnerability via SVG's animate tag reported by Valentin T., CrowdStrike. in 1.6.12
- security Fix Information Disclosure vulnerability in the HTML style sanitizer reported by somerandomdev. in 1.6.12
- security Remove X-XSS-Protection example from .htaccess file (#9875) in 1.6.12
- security Fix Cross-Site-Scripting vulnerability via SVG's animate tag in 1.6.12
- security Fix Information Disclosure vulnerability in the HTML style sanitizer in 1.6.12
- security Fix Post-Auth RCE via PHP Object Deserialization reported by firs0v. in 1.6.11
- security Fix XSS vulnerability in post-processing of sanitized HTML content [CVE-2024-42009] in 1.6.8
- security Fix XSS vulnerability in serving of attachments other than HTML or SVG [CVE-2024-42008] in 1.6.8
- security Fix information leak (access to remote content) via insufficient CSS filtering [CVE-2024-42010] in 1.6.8
- security Fix cross-site scripting (XSS) vulnerability in handling SVG animate attributes. Reported by Valentin T. and Lutz Wolf of CrowdStrike. in 1.6.7
- security Fix cross-site scripting (XSS) vulnerability in handling list columns from user preferences. Reported by Huy Nguyễn Phạm Nhật. in 1.6.7
- security Fix cross-site scripting (XSS) vulnerability in handling SVG animate attributes in 1.6.7
- security Fix cross-site scripting (XSS) vulnerability in handling list columns from user preferences in 1.6.7
- security Update to TinyMCE 5.10.9 security release (#9228) in 1.6.6
- security Fix cross-site scripting (XSS) vulnerability in setting Content-Type/Content-Disposition for attachment preview/download reported by Rene Rehme (rehme.infosec). in 1.6.5
- security Fix cross-site scripting (XSS) vulnerability in setting Content-Type/Content-Disposition for attachment preview/download in 1.6.5
Every release in between
securityFix stored XSS/HTML/CSS injection in subject field of the draft restore dialog, reported by Anand Jogawade (zazy)
fixFix CSS injection bypass in HTML sanitizer via SVG , reported by wooseokdotkim
securityFix pre-auth SQL injection in virtuser_query plugin via preg_replace backslash escape bypass, reported by skull
securityFix SSRF bypass via specific local address URLs
securityFix local/private URL fetch bypass when remote resources were not allowed, reported by Orange Cyberdefense Vulnerability Disclosure Team
fixFix bypass of remote image blocking via CSS var(), reported by Geame
fixFix pre-auth arbitrary file delete via redis/memcache session poisoning bypass, reported by valent1
securityFix code injection vulnerability - remove support for code evaluation in LDAP autovalues option, reported by Glendaenri
fixFix potential too long value in IMAP ID command (#10136)
securitySecurity: Fix stored XSS/HTML/CSS injection in subject field of the draft restore dialog
securitySecurity: Fix CSS injection bypass in HTML sanitizer via SVG
securitySecurity: Fix pre-auth SQL injection in virtuser_query plugin via preg_replace backslash escape bypass
securitySecurity: Fix SSRF bypass via specific local address URLs
securitySecurity: Fix bypass of remote image blocking via CSS var()
securitySecurity: Fix local/private URL fetch bypass when remote resources were not allowed
securitySecurity: Fix pre-auth arbitrary file delete via redis/memcache session poisoning bypass
securitySecurity: Fix code injection vulnerability - remove support for code evaluation in LDAP autovalues option
otherSVG Animate FUNCIRI Attribute Bypass — Remote Image Loading via fill/filter/stroke, reported by class_nzm.
fixFix regression where mail search would fail on non-ascii search criteria (#10121)
fixFix regression where some data url images could get ignored/lost (#10128)
fixFix SVG Animate FUNCIRI Attribute Bypass — Remote Image Loading via fill/filter/stroke
fixFix pre-auth arbitrary file write via unsafe deserialization in redis/memcache session handler, reported by y0us.
fixFix bug where a password could get changed without providing the old password, reported by flydragon777.
securityFix IMAP Injection + CSRF bypass in mail search, reported by Martila Security Research Team.
fixFix remote image blocking bypass via various SVG animate attributes, reported by nullcathedral.
fixFix remote image blocking bypass via a crafted body background attribute, reported by nullcathedral.
fixFix fixed position mitigation bypass via use of !important, reported by nullcathedral.
securityFix XSS issue in a HTML attachment preview, reported by aikido_security.
securityFix SSRF + Information Disclosure via stylesheet links to a local network hosts, reported by Georgios Tsimpidas (aka Frey), Security Researcher at https://i0.rs/.
fixFix Postgres connection using IPv6 address (#10104)
securitySecurity: Fix pre-auth arbitrary file write via unsafe deserialization in redis/memcache session handler
securitySecurity: Fix bug where a password could get changed without providing the old password
securitySecurity: Fix IMAP Injection + CSRF bypass in mail search
securitySecurity: Fix remote image blocking bypass via various SVG animate attributes
securitySecurity: Fix remote image blocking bypass via a crafted body background attribute
securitySecurity: Fix fixed position mitigation bypass via use of !important
securitySecurity: Fix XSS issue in a HTML attachment preview
securitySecurity: Fix SSRF + Information Disclosure via stylesheet links to a local network hosts
securityFix CSS injection vulnerability reported by CERT Polska.
fixFix remote image blocking bypass via SVG content reported by nullcathedral.
fixManagesieve: Fix handling of string-list format values for date tests in Out of Office (#10075)
securityFix Cross-Site-Scripting vulnerability via SVG's animate tag reported by Valentin T., CrowdStrike.
securityFix Information Disclosure vulnerability in the HTML style sanitizer reported by somerandomdev.
otherSupport IPv6 in database DSN (#9937)
otherDon't force specific error_reporting setting
fixFix compatibility with PHP 8.5 regarding array_first()
securityRemove X-XSS-Protection example from .htaccess file (#9875)
fixFix "Assign to group" action state after creation of a first group (#9889)
fixFix bug where contacts search would fail if contactlist_fields contained vcard fields (#9850)
fixFix bug where an mbox export file could include inconsistent message delimiters (#9879)
fixFix parsing of inline styles that aren't well-formatted (#9948)
securityFix Cross-Site-Scripting vulnerability via SVG's animate tag
securityFix Information Disclosure vulnerability in the HTML style sanitizer
securityFix Post-Auth RCE via PHP Object Deserialization reported by firs0v.
fixManagesieve: Fix match-type selector (remove unsupported options) in delete header action (#9610)
otherImprove installer to fix confusion about disabling SMTP authentication (#9801)
fixFix PHP warning in index.php (#9813)
fixOAuth: Fix/improve token refresh
fixFix dark mode bug where wrong colors were used for blockquotes in HTML mail preview (#9820)
fixFix HTML message preview if it contains floating tables (#9804)
fixFix removing/expiring redis/memcache records when using a key prefix
fixFix bug where a wrong SPECIAL-USE folder could have been detected, if there were more than one per-type (#9781)
fixFix a default value and documentation of password_ldap_encodage option (#9658)
breakingRemove mobile/floating Create button from the list in Settings > Folders (#9661)
fixFix Delete and Empty buttons state while creating a folder (#9047)
fixFix connecting to LDAP using ldapi:// URI (#8990)
fixFix cursor position on "below the quote" reply in HTML mode (#8700)
fixFix bug where attachments with content type of application/vnd.ms-tnef were not parsed (#7119)
featureIMAP: Partial support for ANNOTATE-EXPERIMENT-1 extension (RFC 5257)
otherOAuth: Support standard authentication with short-living password received with OIDC token (#9530)
fixFix PHP warnings (#9616, #9611)
fixFix whitespace handling in vCard line continuation (#9637)
fixFix current script state after initial scripts creation in managesieve_kolab_master mode
fixFix rcube_imap::get_vendor() result (and PHP warning) on Zimbra server (#9650)
fixFix regression causing inline SVG images to be missing in mail preview (#9644)
fixFix plugin "virtuser_file" to handle backward slashes in username (#9668)
fixFix PHP fatal error when parsing some malformed BODYSTRUCTURE responses (#9689)
fixFix insert_or_update() and reading database server config on PostgreSQL (#9710)
fixFix Oauth issues with use_secure_urls=true (#9722)
fixFix handling of binary mail parts (e.g. PDF) encoded with quoted-printable (#9728)
fixFix links in comments and config to https:// where available (#9759, #9756)
fixFix decoding of attachment names encoded using both RFC2231 and RFC2047 standards (#9725)
fixFix regression where printing/scaling/rotating image attachments was broken (#9571)
fixFix regression where HTML messages were displayed unstyled (#9586)
securityFix XSS vulnerability in post-processing of sanitized HTML content [CVE-2024-42009]
securityFix XSS vulnerability in serving of attachments other than HTML or SVG [CVE-2024-42008]
securityFix information leak (access to remote content) via insufficient CSS filtering [CVE-2024-42010]
otherManagesieve: Protect special scripts in managesieve_kolab_master mode
fixFix newmail_notifier notification focus in Chrome (#9467)
fixFix fatal error when parsing some TNEF attachments (#9462)
fixFix double scrollbar when composing a mail with many plain text lines (#7760)
fixFix decoding mail parts with multiple base64-encoded text blocks (#9290)
fixFix bug where some messages could get malformed in an import from a MBOX file (#9510)
fixFix invalid line break characters in multi-line text in Sieve scripts (#9543)
fixFix bug where "with attachment" filter could fail on some fts engines (#9514)
fixFix bug where an unhandled exception was caused by an invalid image attachment (#9475)
fixFix bug where a long subject title could not be displayed in some cases (#9416)
fixFix infinite loop when parsing malformed Sieve script (#9562)
fixFix bug where imap_conn_option's 'socket' was ignored (#9566)
securityFix cross-site scripting (XSS) vulnerability in handling SVG animate attributes. Reported by Valentin T. and Lutz Wolf of CrowdStrike.
securityFix cross-site scripting (XSS) vulnerability in handling list columns from user preferences. Reported by Huy Nguyễn Phạm Nhật.
fixFix command injection via crafted im_convert_path/im_identify_path on Windows. Reported by Huy Nguyễn Phạm Nhật.
otherMakefile: Use phpDocumentor v3.4 for the Framework docs (#9313)
fixFix bug where HTML entities in URLs were not decoded on HTML to plain text conversion (#9312)
fixFix bug in collapsing/expanding folders with some special characters in names (#9324)
fixFix PHP8 warnings (#9363, #9365, #9429)
fixFix missing field labels in CSV import, for some locales (#9393)
securityFix cross-site scripting (XSS) vulnerability in handling SVG animate attributes
securityFix cross-site scripting (XSS) vulnerability in handling list columns from user preferences
fixFix command injection via crafted im_convert_path/im_identify_path on Windows
fixFix regression in handling LDAP search_fields configuration parameter (#9210)
fixEnigma: Fix finding of a private key when decrypting a message using GnuPG v2.3
fixFix page jump menu flickering on click (#9196)
securityUpdate to TinyMCE 5.10.9 security release (#9228)
fixFix PHP8 warnings (#9235, #9238, #9242, #9306)
fixFix saving other encryption settings besides enigma's (#9240)
fixFix unneeded php command use in installto.sh and deluser.sh scripts (#9237)
fixFix TinyMCE localization installation (#9266)
breakingFix bug where trailing non-ascii characters in email addresses could have been removed in recipient input (#9257)
fixFix IMAP GETMETADATA command with options - RFC5464
securityFix cross-site scripting (XSS) vulnerability in setting Content-Type/Content-Disposition for attachment preview/download reported by Rene Rehme (rehme.infosec).
fixFix PHP8 fatal error when parsing a malformed BODYSTRUCTURE (#9171)
fixFix duplicated Inbox folder on IMAP servers that do not use Inbox folder with all capital letters (#9166)
fixFix PHP warnings (#9174)
fixFix UI issue when dealing with an invalid managesieve_default_headers value (#9175)
fixFix bug where images attached to application/smil messages weren't displayed (#8870)
fixFix PHP string replacement error in utils/error.php (#9185)
fixFix regression where smtp_user did not allow pre/post strings before/after %u placeholder (#9162)
securityFix cross-site scripting (XSS) vulnerability in setting Content-Type/Content-Disposition for attachment preview/download