[Pkg-roundcube-maintainers] Bug#1151279: roundcube: Multiple security vulnerabilities

[Edmund Lodewijks]

On 2026/10/19 16:22, Guilhem Moulin wrote:
> Source: roundcube
> Version: 1.6.19+dfsg-1
> Control: found -1 1.6.19+dfsg-0+deb13u1
> Control: found -1 1.6.5+dfsg-1+deb12u12
> Severity: important
> Tags: security upstream
> X-Debbugs-Cc: Debian Security Team <team at security.debian.org>
> 
> Roundcube webmail upstream has just released 1.6.20 [0] which fixes a
> new batch of security vulnerabilities:
> 
> ...
> 
> AFAIK no CVE-ID have been published for these issues.  I'm quite busy this week and will
> probably not find time to file MITRE's form before the week-end.

Here we go:

   * Fix IMAP command injection via CRLF in _uid parameter of 
mail/headers and mail/viewsource
     action
  
https://github.com/roundcube/roundcubemail/commit/f62879defc0330ae240c72b83b2d00a8ab337447
     CVE-2026-113386
     https://www.cve.org/CVERecord?id=CVE-2026-113386
   * Fix bug where an alias login wasn’t qualified by IMAP host
  
https://github.com/roundcube/roundcubemail/commit/cb235cbfef88cbf78236dc67d3b667bf3dc61ddd
     CVE-2026-114732
     https://www.cve.org/CVERecord?id=CVE-2026-114732
   * Add a size limit to the CSS proxy content processing
  
https://github.com/roundcube/roundcubemail/commit/99a5bdd05b01f45493cc0da4c96968eac7668126
     CVE-2026-114731
     https://www.cve.org/CVERecord?id=CVE-2026-114731
   * Fix SSRF filter (is_local_url()) bypass via NAT64 64:ff9b::/96
  
https://github.com/roundcube/roundcubemail/commit/3c3a65f66b53b7aaf3d720acd06e0b102eceb090
     CVE-2026-114730
     https://www.cve.org/CVERecord?id=CVE-2026-114730
   * Fix remote content blocking bypass via SVG SMIL by attribute
  
https://github.com/roundcube/roundcubemail/commit/2b6ff79d8b14f94b0ff04765b7f02dbfdfe98efa
     CVE-2026-114729
     https://www.cve.org/CVERecord?id=CVE-2026-114729
   * Fix remote content blocking bypass via CSS escapes in FuncIRI 
attributes (again)
  
https://github.com/roundcube/roundcubemail/commit/ff4fcfdd2952f9d09947cc9c18137f381f27caf1
     CVE-2026-114728
     https://www.cve.org/CVERecord?id=CVE-2026-114728
   * Fix passing potentally unsafe attachment content into ImageMagick 
on image resize
  
https://github.com/roundcube/roundcubemail/commit/895d88af37720d2b46e4553f524013b2e1cb7665
     CVE-2026-114727
     https://www.cve.org/CVERecord?id=CVE-2026-114727
   * Fix mail header injection via the From display-name in the Bounce 
(resend) action
  
https://github.com/roundcube/roundcubemail/commit/3a136465c965776a5f636587187626985dae4f3b
     CVE-2026-114726
     https://www.cve.org/CVERecord?id=CVE-2026-114726
   * Fix mail header injection via 
References/In-Reply-To/Message-ID/From parameters
  
https://github.com/roundcube/roundcubemail/commit/79adcfc0c48012bbbe930278471425027fd7331c
     CVE-2026-114725
     https://www.cve.org/CVERecord?id=CVE-2026-114725
   * Fix object injection primitive in rcube_session::unserialize() via 
“!”-prefixed session
     keys
  
https://github.com/roundcube/roundcubemail/commit/833770d3d3c35cfde74cc2614d368f25a75b6f99
     CVE-2026-114724
     https://www.cve.org/CVERecord?id=CVE-2026-114724
  
https://github.com/roundcube/roundcubemail/commit/0bea81121efd96f07432a837f391dbdd0dffa33f
     CVE-2026-114723
     https://www.cve.org/CVERecord?id=CVE-2026-114723
   * Fix CSS scoping bypass in HTML messages using at-rules
  
https://github.com/roundcube/roundcubemail/commit/ff9cf4a9bf3b7c66db9afe43fe5f1cc73b47ed35
     CVE-2026-114722
     https://www.cve.org/CVERecord?id=CVE-2026-114722
   * Fix bug where deprecated action aliases bypassed disabled_actions 
setting
  
https://github.com/roundcube/roundcubemail/commit/e7c512ae09ebd0ae5d0d2f29e00a767bf91f6bbe
     CVE-2026-114721
     https://www.cve.org/CVERecord?id=CVE-2026-114721
   * Fix IMAP command injection via CRLF in _flag parameter of mail/mark 
action
  
https://github.com/roundcube/roundcubemail/commit/242c6d6a150c850bd96d20d400261e71f8d11f9b
     CVE-2026-114720
     https://www.cve.org/CVERecord?id=CVE-2026-114720
   * Fix CSRF validation bypass in the mark-as-junk action
  
https://github.com/roundcube/roundcubemail/commit/15b0dc0d6e5712310c8f663577361bf8132a7f81
     CVE-2026-114719
     https://www.cve.org/CVERecord?id=CVE-2026-114719
   * Fix XSS issue in handling of password driver error responses
  
https://github.com/roundcube/roundcubemail/commit/94298856ee67ff7817cc4def2adb634be91e28c7
     CVE-2026-114718
     https://www.cve.org/CVERecord?id=CVE-2026-114718
   * Fix mail header injection via subject of a message forwarded as 
attachment
  
https://github.com/roundcube/roundcubemail/commit/c325953a251d0132f1909569b3eac0b974095dd4
     CVE-2026-114717
     https://www.cve.org/CVERecord?id=CVE-2026-114717
   * Fix mail header injection via media type in an inline image data URI
  
https://github.com/roundcube/roundcubemail/commit/adb9b9b3fd43e30af1c166b79494726d89f828eb
     CVE-2026-114716
     https://www.cve.org/CVERecord?id=CVE-2026-114716
   * Fix bug where Password Modoboa driver could change password for 
another account
  
https://github.com/roundcube/roundcubemail/commit/3d9d05bfe2da7f93b8d47e68cadab22bb67e6cc9
     CVE-2026-114715
     https://www.cve.org/CVERecord?id=CVE-2026-114715
   * Fix unsafe use of a login name in SquirrelMail import file path
  
https://github.com/roundcube/roundcubemail/commit/15fd175d154311ca7f59cf696c6cc39471611aa6
     CVE-2026-114714
     https://www.cve.org/CVERecord?id=CVE-2026-114714


-- 
Edmund Lodewijks <edmund at proteamail.com>
TZ: UTC+2 / GMT+2