[Git][security-tracker-team/security-tracker][master] Process second batch of roundcube CVEs
Salvatore Bonaccorso (@carnil)
carnil at debian.org
Thu Oct 22 10:09:34 BST 2026
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker
Commits:
0871bd7f by Salvatore Bonaccorso at 2026-10-22T10:56:36+02:00
Process second batch of roundcube CVEs
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -480,34 +480,6 @@ CVE-2026-13319 (GitLab has remediated an issue in GitLab CE/EE affecting all ver
NOT-FOR-US: GitLab (used to be packaged in the Debian archive as src:gitlab, but never in a stable release)
CVE-2026-12664 (GitLab has remediated an issue in GitLab CE/EE affecting all versions ...)
NOT-FOR-US: GitLab (used to be packaged in the Debian archive as src:gitlab, but never in a stable release)
-CVE-2026-114727 (Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 passes potentia ...)
- TODO: check
-CVE-2026-114726 (Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by ...)
- TODO: check
-CVE-2026-114725 (Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by ...)
- TODO: check
-CVE-2026-114724 (Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 contains an obj ...)
- TODO: check
-CVE-2026-114723 (Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 allows the Imag ...)
- TODO: check
-CVE-2026-114722 (Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by ...)
- TODO: check
-CVE-2026-114721 (Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 allows the disa ...)
- TODO: check
-CVE-2026-114720 (Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by ...)
- TODO: check
-CVE-2026-114719 (Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by ...)
- TODO: check
-CVE-2026-114718 (Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by ...)
- TODO: check
-CVE-2026-114717 (Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by ...)
- TODO: check
-CVE-2026-114716 (Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by ...)
- TODO: check
-CVE-2026-114715 (Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by ...)
- TODO: check
-CVE-2026-114714 (Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by ...)
- TODO: check
CVE-2026-114664 (Frappe Framework before 16.33.0 contains a blind SQL injection vulnera ...)
NOT-FOR-US: Frappe
CVE-2026-114663 (Vyper 0.4.0b1 through 0.5.0b1 miscompiles unfoldable constants and omi ...)
@@ -6057,59 +6029,59 @@ CVE-2026-114728 [Fix remote content blocking bypass via CSS escapes in FuncIRI a
- roundcube 1.6.20+dfsg-1 (bug #1151279)
NOTE: https://roundcube.net/news/2026/10/19/security-updates-1.6.20-and-1.7.5
NOTE: Fixed by: https://github.com/roundcube/roundcubemail/commit/ff4fcfdd2952f9d09947cc9c18137f381f27caf1 (1.6.20)
-CVE-2026-XXXX [Fix passing potentally unsafe attachment content into ImageMagick on image resize]
+CVE-2026-114727 [Fix passing potentally unsafe attachment content into ImageMagick on image resize]
- roundcube 1.6.20+dfsg-1 (bug #1151279)
NOTE: https://roundcube.net/news/2026/10/19/security-updates-1.6.20-and-1.7.5
NOTE: Fixed by: https://github.com/roundcube/roundcubemail/commit/895d88af37720d2b46e4553f524013b2e1cb7665 (1.6.20)
-CVE-2026-XXXX [Fix mail header injection via the From display-name in the Bounce (resend) action]
+CVE-2026-114726 [Fix mail header injection via the From display-name in the Bounce (resend) action]
- roundcube 1.6.20+dfsg-1 (bug #1151279)
NOTE: https://roundcube.net/news/2026/10/19/security-updates-1.6.20-and-1.7.5
NOTE: Fixed by: https://github.com/roundcube/roundcubemail/commit/3a136465c965776a5f636587187626985dae4f3b (1.6.20)
-CVE-2026-XXXX [Fix mail header injection via References/In-Reply-To/Message-ID/From parameters]
+CVE-2026-114725 [Fix mail header injection via References/In-Reply-To/Message-ID/From parameters]
- roundcube 1.6.20+dfsg-1 (bug #1151279)
NOTE: https://roundcube.net/news/2026/10/19/security-updates-1.6.20-and-1.7.5
NOTE: Fixed by: https://github.com/roundcube/roundcubemail/commit/79adcfc0c48012bbbe930278471425027fd7331c (1.6.20)
-CVE-2026-XXXX [Fix object injection primitive in rcube_session::unserialize() via "!"-prefixed session keys]
+CVE-2026-114724 [Fix object injection primitive in rcube_session::unserialize() via "!"-prefixed session keys]
- roundcube 1.6.20+dfsg-1 (bug #1151279)
NOTE: https://roundcube.net/news/2026/10/19/security-updates-1.6.20-and-1.7.5
NOTE: Fixed by: https://github.com/roundcube/roundcubemail/commit/833770d3d3c35cfde74cc2614d368f25a75b6f99 (1.6.20)
-CVE-2026-XXXX [Fix ImageMagick resource limits bypass by GD fallback during thumbnail generation]
+CVE-2026-114723 [Fix ImageMagick resource limits bypass by GD fallback during thumbnail generation]
- roundcube 1.6.20+dfsg-1 (bug #1151279)
NOTE: https://roundcube.net/news/2026/10/19/security-updates-1.6.20-and-1.7.5
NOTE: Fixed by: https://github.com/roundcube/roundcubemail/commit/0bea81121efd96f07432a837f391dbdd0dffa33f (1.6.20)
-CVE-2026-XXXX [Fix CSS scoping bypass in HTML messages using at-rules]
+CVE-2026-114722 [Fix CSS scoping bypass in HTML messages using at-rules]
- roundcube 1.6.20+dfsg-1 (bug #1151279)
NOTE: https://roundcube.net/news/2026/10/19/security-updates-1.6.20-and-1.7.5
NOTE: Fixed by: https://github.com/roundcube/roundcubemail/commit/ff9cf4a9bf3b7c66db9afe43fe5f1cc73b47ed35 (1.6.20)
-CVE-2026-XXXX [Fix bug where deprecated action aliases bypassed disabled_actions setting]
+CVE-2026-114721 [Fix bug where deprecated action aliases bypassed disabled_actions setting]
- roundcube 1.6.20+dfsg-1 (bug #1151279)
NOTE: https://roundcube.net/news/2026/10/19/security-updates-1.6.20-and-1.7.5
NOTE: Fixed by: https://github.com/roundcube/roundcubemail/commit/e7c512ae09ebd0ae5d0d2f29e00a767bf91f6bbe (1.6.20)
-CVE-2026-XXXX [Fix IMAP command injection via CRLF in _flag parameter of mail/mark action]
+CVE-2026-114720 [Fix IMAP command injection via CRLF in _flag parameter of mail/mark action]
- roundcube 1.6.20+dfsg-1 (bug #1151279)
NOTE: https://roundcube.net/news/2026/10/19/security-updates-1.6.20-and-1.7.5
NOTE: Fixed by: https://github.com/roundcube/roundcubemail/commit/242c6d6a150c850bd96d20d400261e71f8d11f9b (1.6.20)
-CVE-2026-XXXX [Fix CSRF validation bypass in the mark-as-junk action]
+CVE-2026-114719 [Fix CSRF validation bypass in the mark-as-junk action]
- roundcube 1.6.20+dfsg-1 (bug #1151279)
NOTE: https://roundcube.net/news/2026/10/19/security-updates-1.6.20-and-1.7.5
NOTE: Fixed by: https://github.com/roundcube/roundcubemail/commit/15b0dc0d6e5712310c8f663577361bf8132a7f81 (1.6.20)
-CVE-2026-XXXX [Fix XSS issue in handling of password driver error responses]
+CVE-2026-114718 [Fix XSS issue in handling of password driver error responses]
- roundcube 1.6.20+dfsg-1 (bug #1151279)
NOTE: https://roundcube.net/news/2026/10/19/security-updates-1.6.20-and-1.7.5
NOTE: Fixed by: https://github.com/roundcube/roundcubemail/commit/94298856ee67ff7817cc4def2adb634be91e28c7 (1.6.20)
-CVE-2026-XXXX [Fix mail header injection via subject of a message forwarded as attachment]
+CVE-2026-114717 [Fix mail header injection via subject of a message forwarded as attachment]
- roundcube 1.6.20+dfsg-1 (bug #1151279)
NOTE: https://roundcube.net/news/2026/10/19/security-updates-1.6.20-and-1.7.5
NOTE: Fixed by: https://github.com/roundcube/roundcubemail/commit/c325953a251d0132f1909569b3eac0b974095dd4 (1.6.20)
-CVE-2026-XXXX [Fix mail header injection via media type in an inline image data URI]
+CVE-2026-114716 [Fix mail header injection via media type in an inline image data URI]
- roundcube 1.6.20+dfsg-1 (bug #1151279)
NOTE: https://roundcube.net/news/2026/10/19/security-updates-1.6.20-and-1.7.5
NOTE: Fixed by: https://github.com/roundcube/roundcubemail/commit/adb9b9b3fd43e30af1c166b79494726d89f828eb (1.6.20)
-CVE-2026-XXXX [Fix bug where Password Modoboa driver could change password for another account]
+CVE-2026-114715 [Fix bug where Password Modoboa driver could change password for another account]
- roundcube 1.6.20+dfsg-1 (bug #1151279)
NOTE: https://roundcube.net/news/2026/10/19/security-updates-1.6.20-and-1.7.5
NOTE: Fixed by: https://github.com/roundcube/roundcubemail/commit/3d9d05bfe2da7f93b8d47e68cadab22bb67e6cc9 (1.6.20)
-CVE-2026-XXXX [Fix unsafe use of a login name in SquirrelMail import file path]
+CVE-2026-114714 [Fix unsafe use of a login name in SquirrelMail import file path]
- roundcube 1.6.20+dfsg-1 (bug #1151279)
NOTE: https://roundcube.net/news/2026/10/19/security-updates-1.6.20-and-1.7.5
NOTE: Fixed by: https://github.com/roundcube/roundcubemail/commit/15fd175d154311ca7f59cf696c6cc39471611aa6 (1.6.20)
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/0871bd7fdcd403c987a8b07d51d0d4946094f01f
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/0871bd7fdcd403c987a8b07d51d0d4946094f01f
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261022/9d977709/attachment.htm>
More information about the debian-security-tracker-commits
mailing list