Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package roundcubemail for openSUSE:Factory checked in at 2026-10-17 21:26:07 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/roundcubemail (Old) and /work/SRC/openSUSE:Factory/.roundcubemail.new.3698736 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "roundcubemail" Sat Oct 17 21:26:07 2026 rev:96 rq:1385283 version:1.6.19 Changes: -------- --- /work/SRC/openSUSE:Factory/roundcubemail/roundcubemail.changes 2026-05-27 16:31:29.920618438 +0200 +++ /work/SRC/openSUSE:Factory/.roundcubemail.new.3698736/roundcubemail.changes 2026-10-17 21:26:14.072963147 +0200 @@ -1,0 +2,63 @@ +Fri Oct 16 18:33:53 UTC 2026 - Aeneas Jaißle <[email protected]> + +- update to 1.6.19 + This is a security update to the version 1.6 of Roundcube Webmail. + It provides fixes to recently reported security vulnerabilities: + + + Fix CSS declaration smuggling via un-encoded ampersand emission, reported by Zach Hanley of Horizon3.ai + + Fix CSS property injection via body background attribute, reported by zenithhostingevan + + Fix email header injection via bare CR in the subject field, reported by CVE-Hunter-Leo + + Fix email header injection via C-escape \r in the recipient display name, reported by dogeshark + + Fix email header injection via identity's organization field, reported by dogeshark + + Fix zero-click stored XSS via TNEF MIME tag injection in the attachment URL, reported by nakko + + Fix XSS in the HTML editor using text/enriched part content, reported by Joshua Rogers + + Fix cross-user access in contact group membership (add/remove) in the SQL address book, reported by Joshua Rogers + + Fix is_local_url() bypass via trailing-dot FQDN in stylesheet URL, reported by nept1337 + + Fix remote content blocking bypass via CSS escapes in FuncIRI attributes, reported by neoxed + + Fix remote-content blocker bypass via SVG SMIL src animation + + Fix SSRF bypass in Roundcube CSS proxy via hexadecimal IPv6-mapped IPv4 addresses, reported by faceless0x7 and Harish Annavisamy + + This version is considered stable and we recommend to update all productive + installations of Roundcube with it. Please do backup your data before updating! + + CHANGELOG 1.6.19 [boo#1279459] + + Fix PHP Warning: Undefined variable $tmp_command in .../plugins/markasjunk/drivers/cmd_learn.php (#10294) + + Security: Fix CSS declaration smuggling via un-encoded ampersand emission + + Security: Fix CSS property injection via body background attribute + + Security: Fix email header injection via bare CR in the subject field + + Security: Fix email header injection via C-escape \r in the recipient display name + + Security: Fix email header injection via identity's organization field + + Security: Fix zero-click stored XSS via TNEF MIME tag injection in the attachment URL + + Security: Fix XSS in the HTML editor using text/enriched part content + + Security: Fix cross-user access in contact group membership (add/remove) in the SQL address book + + Security: Fix is_local_url() bypass via trailing-dot FQDN in stylesheet URL + + Security: Fix remote content blocking bypass via CSS escapes in FuncIRI attributes + + Security: Fix remote-content blocker bypass via SVG SMIL src animation + + Security: Fix SSRF bypass in Roundcube CSS proxy via hexadecimal IPv6-mapped IPv4 addresses + + CHANGELOG 1.6.18 [boo#1275552] + + Password: Fix fatal error "Class 'Zxcvbn' not found" (#10274) + + Fix out-of-bounds string reads on truncated compressed-RTF in the TNEF decoder (#10269) + + Security: Add basic validation for content proxied by the css proxy [CVE-2026-74998] [boo#1275324] + + Security: Fix SSRF bypass via specific local address URLs using 100.64.0.0/10 and fe80::/10 nets [CVE-2026-75006] [boo#1275319] + + Security: Fix SSRF filter bypass via various forms of nip.io/sslip.io hostnames evading is_local_url() check [CVE-2026-75006] [boo#1275319] + + Security: Fix remote content blocking bypass via unclosed url() in a FuncIRI attribute [CVE-2026-75003] [boo#1275320] + + Security: Fix LDAP filter injection via unescaped %u/%fu/%d substitution into the search_filter [CVE-2026-75007] [boo#1275318] + + Security: Fix arbitrary Sieve script injection via a filter rule name bypassing managesieve_disabled_actions [CVE-2026-75004] [boo#1275445] + + Security: Fix RCE via cmd_learn driver of markasjunk plugin [CVE-2026-74997] [boo#1275325] + + Security: Fix IMAP command injection via mail search and LITERAL+ byte-count desynchronization [CVE-2026-75002] [boo#1275321] + + Security: Fix password's modoboa driver leak of an authentication token to a user-controlled host [CVE-2026-75010] [boo#1275317] + + Security: Fix stored XSS in "Add to address book" action [CVE-2026-74999] [boo#1275323] + + Security: Fix HTML/CSS sanitization bypass via SVG animate by attribute [CVE-2026-75000] [boo#1275322] + + CHANGELOG 1.6.17 + + Enigma: Support automatic public key lookup (import) using HKP v1 protocol (#5314) + + Enigma: Kolab WOAT Support (#8626) + + Security: Fix an infinite loop in TNEF (winmail.dat) decoder (#10193) [CVE-2026-62642] [boo#1271475] + + Security: Fix various vulnerabilities in the password plugin using session-injected username [CVE-2026-62644] [boo#1271474] + + Security: Fix stored XSS via unescaped attachment MIME type on the attachment-validation warning page [CVE-2026-54432] [boo#1271471] + + Security: Fix SSRF bypass via specific local address URLs - two new cases [CVE-2026-62643] [boo#1271477] + + Security: Fix zero-click stored XSS in plain-text rendering [CVE-2026-54433] [boo#1271472] + + Security: Fix DoS via crafted compressed-RTF size in the TNEF (winmail.dat) file [CVE-2026-62641] [boo#1271476] + +------------------------------------------------------------------- Old: ---- roundcubemail-1.6.16-complete.tar.gz roundcubemail-1.6.16-complete.tar.gz.asc New: ---- roundcubemail-1.6.19-complete.tar.gz roundcubemail-1.6.19-complete.tar.gz.asc ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ roundcubemail.spec ++++++ --- /var/tmp/diff_new_pack.OLZh9C/_old 2026-10-17 21:26:15.047003786 +0200 +++ /var/tmp/diff_new_pack.OLZh9C/_new 2026-10-17 21:26:15.048003828 +0200 @@ -20,7 +20,7 @@ %define roundcubeconfigpath %{_sysconfdir}/%{name} Name: roundcubemail -Version: 1.6.16 +Version: 1.6.19 Release: 0 Summary: A browser-based multilingual IMAP client License: BSD-3-Clause AND GPL-2.0-only AND GPL-3.0-or-later ++++++ roundcubemail-1.6.16-complete.tar.gz -> roundcubemail-1.6.19-complete.tar.gz ++++++ ++++ 16757 lines of diff (skipped)
