[Git][security-tracker-team/security-tracker][master] More CVEs assigned for roundcube issues

[Salvatore Bonaccorso (@carnil)]

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
820418de by Salvatore Bonaccorso at 2026-07-15T08:50:48+02:00
More CVEs assigned for roundcube issues

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -4791,23 +4791,23 @@ CVE-2026-12386 (Improper null termination vulnerability in TUBITAK BILGEM Softwa
 	NOT-FOR-US: TUBITAK BILGEM
 CVE-2026-12250 (Invocation of process using visible sensitive information vulnerabilit ...)
 	NOT-FOR-US: TUBITAK BILGEM
-CVE-2026-XXXX [DoS via crafted compressed-RTF size in the TNEF (winmail.dat) file]
+CVE-2026-62641 [DoS via crafted compressed-RTF size in the TNEF (winmail.dat) file]
 	- roundcube 1.6.17+dfsg-1 (bug #1141495)
 	NOTE: https://github.com/roundcube/roundcubemail/commit/bf253c72d4293c93fda511b8464fe9cb34b522c1 (1.6.17)
 CVE-2026-54433
 	- roundcube 1.6.17+dfsg-1 (bug #1141495)
 	NOTE: https://github.com/roundcube/roundcubemail/commit/63e42e233c6e8b5100e2e61a4d13addcd1a45bd5 (1.6.17)
-CVE-2026-XXXX [SSRF bypass via specific local address URLs]
+CVE-2026-62643 [SSRF bypass via specific local address URLs]
 	- roundcube 1.6.17+dfsg-1 (bug #1141495)
 	NOTE: https://github.com/roundcube/roundcubemail/commit/294c7da6e7284166f040cef8607b677d459e0786 (1.6.17)
 CVE-2026-54432
 	- roundcube 1.6.17+dfsg-1 (bug #1141495)
 	NOTE: https://github.com/roundcube/roundcubemail/commit/a3a4482cc9bd5569107e4393d32abb157cb2a568 (1.6.17)
-CVE-2026-XXXX [Various vulnerabilities in the password plugin using session-injected username]
+CVE-2026-62644 [Various vulnerabilities in the password plugin using session-injected username]
 	- roundcube 1.6.17+dfsg-1 (bug #1141495)
 	NOTE: https://github.com/roundcube/roundcubemail/commit/83150ce04d689a70f92d511bcae40adba8d55476 (1.6.17)
 	NOTE: https://github.com/roundcube/roundcubemail/commit/5cdc6a48b40beabff7f0bf5d9035f4491e877e4c (1.6.17)
-CVE-2026-XXXX [Infinite loop in TNEF (winmail.dat) decoder]
+CVE-2026-62642 [Infinite loop in TNEF (winmail.dat) decoder]
 	- roundcube 1.6.17+dfsg-1 (bug #1141495)
 	NOTE: https://github.com/roundcube/roundcubemail/commit/a007321346380136b3de2bd75b486b04f63c0d38 (1.6.17)
 	NOTE: https://github.com/roundcube/roundcubemail/commit/132ac8dd5a55c8466be12de1daf84355697ffa89 (1.6.17)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/820418de8e40c23ac25b7b382504d3c8b277b839

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/820418de8e40c23ac25b7b382504d3c8b277b839
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20260715/51ecfa91/attachment-0001.htm>