Source: roundcube Severity: important Tags: security Control: found -1 1.3.16+dfsg.1-1~deb10u1 Control: found -1 1.4.11+dfsg.1-4 Control: fixed -1 1.5.0+dfsg.1-1
In a recent post roundcube webmail upstream has announced the
following security fixes:
* Fix XSS issue in handling attachment filename extension in mimetype
mismatch warning
* Fix possible SQL injection via some session variables
sid/bookworm's 1.5.0+dfsg.1-2 is not affected. Upstream fixes for LTS
branches:
1.4.x
https://github.com/roundcube/roundcubemail/commit/faf99bf8a2b7b7562206fa047e8de652861e624a
https://github.com/roundcube/roundcubemail/commit/c8947ecb762d9e89c2091bda28d49002817263f1
1.3.x
https://github.com/roundcube/roundcubemail/commit/7d7b1dfeff795390b69905ceb63d6391b5b0dfe7
https://github.com/roundcube/roundcubemail/commit/ee809bde2dcaa04857a919397808a7296681dcfa
--
Guilhem.
[0]
https://roundcube.net/news/2021/11/12/security-updates-1.4.12-and-1.3.17-released
signature.asc
Description: PGP signature
