Software-update: Roundcube Webmail 1.6.20 / 1.7.5

Er zijn updates verschenen voor versies 1.6 en 1.7 van Roundcube Webmail die diverse beveiligensproblemen moeten verhelpen. Roundcube Webmail biedt een webinterface om e-mail te kunnen lezen en verzenden. Het heeft onder andere ondersteuning voor gedeelde mappen en namespaces, internationalized domain names en SMTP-afleverstatusnotificaties. Daarnaast is de gebruikersinterface voor IMAP-mappen aangepast om zo meer ruimte te bieden voor extensies en plug-ins. De releasenotes voor beide versies kan hieronder worden gevonden.

Security updates 1.6.20 and 1.7.5 released

We just published security updates to the 1.6 LTS and 1.7 versions of Roundcube Webmail. They both contain fixes for recently reported security vulnerabilities.

Security fixes

Fix IMAP command injection via CRLF in _uid parameter of mail/headers and mail/viewsource actionFix bug where an alias login wasn’t qualified by IMAP hostAdd a size limit to the CSS proxy content processingFix SSRF filter (is_local_url()) bypass via NAT64 64:ff9b::/96Fix remote content blocking bypass via SVG SMIL by attributeFix remote content blocking bypass via CSS escapes in FuncIRI attributes (again)Fix passing potentally unsafe attachment content into ImageMagick on image resizeFix mail header injection via the From display-name in the Bounce (resend) actionFix mail header injection via References/In-Reply-To/Message-ID/From parametersFix object injection primitive in rcube_session::unserialize() via “!”-prefixed session keysFix ImageMagick resource limits bypass by GD fallback during thumbnail generationFix CSS scoping bypass in HTML messages using at-rulesFix bug where deprecated action aliases bypassed disabled_actions settingFix IMAP command injection via CRLF in _flag parameter of mail/mark actionFix CSRF validation bypass in the mark-as-junk actionFix XSS issue in handling of password driver error responsesFix mail header injection via subject of a message forwarded as attachmentFix mail header injection via media type in an inline image data URIFix bug where Password Modoboa driver could change password for another accountFix unsafe use of a login name in SquirrelMail import file path

Fix IMAP command injection via CRLF in _uid parameter of mail/headers and mail/viewsource action

Fix bug where an alias login wasn’t qualified by IMAP host

Add a size limit to the CSS proxy content processing

Fix SSRF filter (is_local_url()) bypass via NAT64 64:ff9b::/96

Fix remote content blocking bypass via SVG SMIL by attribute

Fix remote content blocking bypass via CSS escapes in FuncIRI attributes (again)

Fix passing potentally unsafe attachment content into ImageMagick on image resize

Fix mail header injection via the From display-name in the Bounce (resend) action

Fix mail header injection via References/In-Reply-To/Message-ID/From parameters

Fix object injection primitive in rcube_session::unserialize() via “!”-prefixed session keys

Fix ImageMagick resource limits bypass by GD fallback during thumbnail generation

Fix CSS scoping bypass in HTML messages using at-rules

Fix bug where deprecated action aliases bypassed disabled_actions setting

Fix IMAP command injection via CRLF in _flag parameter of mail/mark action

Fix CSRF validation bypass in the mark-as-junk action

Fix XSS issue in handling of password driver error responses

Fix mail header injection via subject of a message forwarded as attachment

Fix mail header injection via media type in an inline image data URI

Fix bug where Password Modoboa driver could change password for another account

Fix unsafe use of a login name in SquirrelMail import file path

See the full changelogs in the release notes on the Github download pages for the updated versions 1.6.20 and 1.7.5. We strongly recommend to update all productive installations of Roundcube 1.6.x and 1.7.x with this new versions.

Source: Tweakers.net