Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package roundcubemail for openSUSE:Factory checked in at 2026-10-21 20:57:14 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/roundcubemail (Old) and /work/SRC/openSUSE:Factory/.roundcubemail.new.2252680 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "roundcubemail" Wed Oct 21 20:57:14 2026 rev:97 rq:1386634 version:1.6.20 Changes: -------- --- /work/SRC/openSUSE:Factory/roundcubemail/roundcubemail.changes 2026-10-17 21:26:14.072963147 +0200 +++ /work/SRC/openSUSE:Factory/.roundcubemail.new.2252680/roundcubemail.changes 2026-10-21 20:58:42.633059527 +0200 @@ -1,0 +2,53 @@ +Tue Oct 20 18:49:50 UTC 2026 - Aeneas Jaißle <[email protected]> + +- update to 1.6.20 + This is a security update to the version 1.6 of Roundcube Webmail. + It provides fixes to recently reported security vulnerabilities: + + + Fix IMAP command injection via CRLF in _uid parameter of mail/headers and mail/viewsource action, reported by Wahab "NeoX" K. + + Fix bug where an alias login wasn't qualified by IMAP host, reported by Milan Hoppe. + + Add a size limit to the CSS proxy content processing, reported by Milan Hoppe. + + Fix SSRF filter (is_local_url()) bypass via NAT64 64:ff9b::/96, reported by dizconnect. + + Fix remote content blocking bypass via SVG SMIL by attribute, reported by Milan Hoppe. + + Fix remote content blocking bypass via CSS escapes in FuncIRI attributes (again), reported by Milan Hoppe. + + Fix passing potentally unsafe attachment content into ImageMagick on image resize, reported by Paulos Yibelo + + Fix mail header injection via the From display-name in the Bounce (resend) action, reported by Clay. + + Fix mail header injection via References/In-Reply-To/Message-ID/From parameters, reported by Sunil Tripathy. + + Fix object injection primitive in rcube_session::unserialize() via "!"-prefixed session keys, reported by Oli Z. + + Fix ImageMagick resource limits bypass by GD fallback during thumbnail generation, reported by GoldenSW. + + Fix CSS scoping bypass in HTML messages using at-rules, reported by GoldenSW. + + Fix bug where deprecated action aliases bypassed disabled_actions setting, reported by Squirt1e, Atum, N0b0dy, and Gh0u1L5. + + Fix IMAP command injection via CRLF in _flag parameter of mail/mark action, reported by Squirt1e, Atum, N0b0dy, and Gh0u1L5. + + Fix CSRF validation bypass in the mark-as-junk action, reported by Squirt1e, Atum, N0b0dy, and Gh0u1L5. + + Fix XSS issue in handling of password driver error responses, reported by Squirt1e, Atum, N0b0dy, and Gh0u1L5. + + Fix mail header injection via subject of a message forwarded as attachment, reported by Squirt1e, Atum, N0b0dy, and Gh0u1L5. + + Fix mail header injection via media type in an inline image data URI, reported by Squirt1e, Atum, N0b0dy, and Gh0u1L5. + + Fix bug where Password Modoboa driver could change password for another account, reported by Squirt1e, Atum, N0b0dy, and Gh0u1L5. + + Fix unsafe use of a login name in SquirrelMail import file path, reported by Squirt1e, Atum, N0b0dy, and Gh0u1L5. + + This version is considered stable and we recommend to update all productive + installations of Roundcube with it. Please do backup your data before updating! + + CHANGELOG + + Security: Fix IMAP command injection via CRLF in _uid parameter of mail/headers and mail/viewsource action [CVE-2026-113386] [boo#1286099] + + Security: Fix bug where an alias login wasn't qualified by IMAP host + + Security: Add a size limit to the CSS proxy content processing + + Security: Fix SSRF filter (is_local_url()) bypass via NAT64 64:ff9b::/96 + + Security: Fix remote content blocking bypass via SVG SMIL by attribute + + Security: Fix remote content blocking bypass via CSS escapes in FuncIRI attributes (again) + + Security: Fix passing potentally unsafe attachment content into ImageMagick on image resize + + Security: Fix mail header injection via the From display-name in the Bounce (resend) action + + Security: Fix mail header injection via References/In-Reply-To/Message-ID/From parameters + + Security: Fix object injection primitive in rcube_session::unserialize() via "!"-prefixed session keys + + Security: Fix ImageMagick resource limits bypass by GD fallback during thumbnail generation + + Security: Fix CSS scoping bypass in HTML messages using at-rules + + Security: Fix bug where deprecated action aliases bypassed disabled_actions setting + + Security: Fix IMAP command injection via CRLF in _flag parameter of mail/mark action + + Security: Fix CSRF validation bypass in the mark-as-junk action + + Security: Fix XSS issue in handling of password driver error responses + + Security: Fix mail header injection via subject of a message forwarded as attachment + + Security: Fix mail header injection via media type in an inline image data URI + + Security: Fix bug where Password Modoboa driver could change password for another account + + Security: Fix unsafe use of a login name in SquirrelMail import file path + +------------------------------------------------------------------- Old: ---- roundcubemail-1.6.19-complete.tar.gz roundcubemail-1.6.19-complete.tar.gz.asc New: ---- roundcubemail-1.6.20-complete.tar.gz roundcubemail-1.6.20-complete.tar.gz.asc ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ roundcubemail.spec ++++++ --- /var/tmp/diff_new_pack.dQY7or/_old 2026-10-21 20:58:43.663102710 +0200 +++ /var/tmp/diff_new_pack.dQY7or/_new 2026-10-21 20:58:43.665102794 +0200 @@ -20,7 +20,7 @@ %define roundcubeconfigpath %{_sysconfdir}/%{name} Name: roundcubemail -Version: 1.6.19 +Version: 1.6.20 Release: 0 Summary: A browser-based multilingual IMAP client License: BSD-3-Clause AND GPL-2.0-only AND GPL-3.0-or-later ++++++ roundcubemail-1.6.19-complete.tar.gz -> roundcubemail-1.6.20-complete.tar.gz ++++++ ++++ 2423 lines of diff (skipped)
