[Git][security-tracker-team/security-tracker][master] Track first batch of CVE ified roundcube issues

[Salvatore Bonaccorso (@carnil)]

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
30799d82 by Salvatore Bonaccorso at 2026-10-22T10:32:16+02:00
Track first batch of CVE ified roundcube issues

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -480,16 +480,6 @@ CVE-2026-13319 (GitLab has remediated an issue in GitLab CE/EE affecting all ver
 	NOT-FOR-US: GitLab (used to be packaged in the Debian archive as src:gitlab, but never in a stable release)
 CVE-2026-12664 (GitLab has remediated an issue in GitLab CE/EE affecting all versions  ...)
 	NOT-FOR-US: GitLab (used to be packaged in the Debian archive as src:gitlab, but never in a stable release)
-CVE-2026-114732 (Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by  ...)
-	TODO: check
-CVE-2026-114731 (Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by  ...)
-	TODO: check
-CVE-2026-114730 (Roundcube Webmail 1.6.14 before 1.6.20 and 1.7.0 before 1.7.5 is affec ...)
-	TODO: check
-CVE-2026-114729 (Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by  ...)
-	TODO: check
-CVE-2026-114728 (Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by  ...)
-	TODO: check
 CVE-2026-114727 (Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 passes potentia ...)
 	TODO: check
 CVE-2026-114726 (Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by  ...)
@@ -6047,23 +6037,23 @@ CVE-2026-113386 (Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 are affe
 	- roundcube 1.6.20+dfsg-1 (bug #1151279)
 	NOTE: https://roundcube.net/news/2026/10/19/security-updates-1.6.20-and-1.7.5
 	NOTE: Fixed by: https://github.com/roundcube/roundcubemail/commit/f62879defc0330ae240c72b83b2d00a8ab337447 (1.6.20)
-CVE-2026-XXXX [Fix bug where an alias login wasn't qualified by IMAP host]
+CVE-2026-114732 [Fix bug where an alias login wasn't qualified by IMAP host]
 	- roundcube 1.6.20+dfsg-1 (bug #1151279)
 	NOTE: https://roundcube.net/news/2026/10/19/security-updates-1.6.20-and-1.7.5
 	NOTE: Fixed by: https://github.com/roundcube/roundcubemail/commit/cb235cbfef88cbf78236dc67d3b667bf3dc61ddd (1.6.20)
-CVE-2026-XXXX [Add a size limit to the CSS proxy content processing]
+CVE-2026-114731 [Add a size limit to the CSS proxy content processing]
 	- roundcube 1.6.20+dfsg-1 (bug #1151279)
 	NOTE: https://roundcube.net/news/2026/10/19/security-updates-1.6.20-and-1.7.5
 	NOTE: Fixed by: https://github.com/roundcube/roundcubemail/commit/99a5bdd05b01f45493cc0da4c96968eac7668126 (1.6.20)
-CVE-2026-XXXX [Fix SSRF filter (is_local_url()) bypass via NAT64 64:ff9b::/96]
+CVE-2026-114730 [Fix SSRF filter (is_local_url()) bypass via NAT64 64:ff9b::/96]
 	- roundcube 1.6.20+dfsg-1 (bug #1151279)
 	NOTE: https://roundcube.net/news/2026/10/19/security-updates-1.6.20-and-1.7.5
 	NOTE: Fixed by: https://github.com/roundcube/roundcubemail/commit/3c3a65f66b53b7aaf3d720acd06e0b102eceb090 (1.6.20)
-CVE-2026-XXXX [Fix remote content blocking bypass via SVG SMIL by attribute]
+CVE-2026-114729 [Fix remote content blocking bypass via SVG SMIL by attribute]
 	- roundcube 1.6.20+dfsg-1 (bug #1151279)
 	NOTE: https://roundcube.net/news/2026/10/19/security-updates-1.6.20-and-1.7.5
 	NOTE: Fixed by: https://github.com/roundcube/roundcubemail/commit/2b6ff79d8b14f94b0ff04765b7f02dbfdfe98efa (1.6.20)
-CVE-2026-XXXX [Fix remote content blocking bypass via CSS escapes in FuncIRI attributes (again)]
+CVE-2026-114728 [Fix remote content blocking bypass via CSS escapes in FuncIRI attributes (again)]
 	- roundcube 1.6.20+dfsg-1 (bug #1151279)
 	NOTE: https://roundcube.net/news/2026/10/19/security-updates-1.6.20-and-1.7.5
 	NOTE: Fixed by: https://github.com/roundcube/roundcubemail/commit/ff4fcfdd2952f9d09947cc9c18137f381f27caf1 (1.6.20)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/30799d82936c3888242b4f1c2b414860f98fb50c

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/30799d82936c3888242b4f1c2b414860f98fb50c
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261022/c4bb4ac6/attachment.htm>