[Git][security-tracker-team/security-tracker][master] CVE-2026-25916/roundcube assigned

[Salvatore Bonaccorso (@carnil)]

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
5d3fefd0 by Salvatore Bonaccorso at 2026-02-09T21:19:32+01:00
CVE-2026-25916/roundcube assigned

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -18,8 +18,6 @@ CVE-2026-2224 (A vulnerability was detected in code-projects Online Reviewer Sys
 	NOT-FOR-US: code-projects
 CVE-2026-2223 (A security vulnerability has been detected in code-projects Online Rev ...)
 	NOT-FOR-US: code-projects
-CVE-2026-25916 (Roundcube Webmail before 1.5.13 and 1.6 before 1.6.13, when "Block rem ...)
-	TODO: check
 CVE-2026-25905 (The Python code being run by 'runPython' or 'runPythonAsync' is not is ...)
 	TODO: check
 CVE-2026-25904 (The Pydantic-AI MCP Run Python tool configures the Deno sandbox with a ...)
@@ -121,10 +119,11 @@ CVE-2026-23901 [shiro: Brute force attack possible to determine valid user names
 	[trixie] - shiro <no-dsa> (Minor issue)
 	[bookworm] - shiro <no-dsa> (Minor issue)
 	NOTE: https://www.openwall.com/lists/oss-security/2026/02/08/2
-CVE-2026-XXXX [remote image blocking bypass via SVG content]
+CVE-2026-25916 [remote image blocking bypass via SVG content]
 	- roundcube 1.6.13+dfsg-1 (bug #1127447)
 	NOTE: Fixed by: https://github.com/roundcube/roundcubemail/commit/036e851b683333205813f70acda2dc047b4891c8 (1.6.13)
 	NOTE: https://roundcube.net/news/2026/02/08/security-updates-1.6.13-and-1.5.13
+	NOTE: https://nullcathedral.com/posts/2026-02-08-roundcube-svg-feimage-remote-image-bypass/
 CVE-2026-XXXX [CSS injection vulnerability]
 	- roundcube 1.6.13+dfsg-1 (bug #1127447)
 	NOTE: Fixed by: https://github.com/roundcube/roundcubemail/commit/1f4c3a5af5033747f9685a8a395dbd8228d19816 (1.6.13)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/5d3fefd0a913ee128dc712cbe6a7bf1ac0481274

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/5d3fefd0a913ee128dc712cbe6a7bf1ac0481274
You're receiving this email because of your account on salsa.debian.org.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20260209/635e70d2/attachment.htm>