Dear Roundcube users We just published new releases which fix a recently reported vulnerability that allows an attacker to overwrite configuration settings using user preferences. This can result in random file access, manipulated SQL queries and even code execution. The latter one only affects versions 0.8.6 and older.
Beside the security fix, the 0.9.5 release also includes other minor bug fixes and improvements. Most notably it brings the default spell checker back after Google suspended their public spell checking service. Please update your installations with the new versions or patch them with the fixes listed below for the various older versions of Roundcube. Download the new versions from http://roundcube.net/download Patch for 0.9.x: https://github.com/roundcube/roundcubemail/commit/4109bb26ce.diff Patch for 0.8.x: https://github.com/roundcube/roundcubemail/commit/eb433aa33c.diff Patch for 0.7.x: https://github.com/roundcube/roundcubemail/commit/1972037274.diff More information about the vulnerability will be published under CVE-2013-6172. Kind regards, Thomas _______________________________________________ Roundcube Development discussion mailing list [email protected] http://lists.roundcube.net/mailman/listinfo/dev
