Debian alert DLA-4480-1 (roundcube)

From:
             
 
Guilhem Moulin <guilhem@debian.org>
To:
             
 
debian-lts-announce@lists.debian.org
Subject:
             
 
[SECURITY] [DLA 4480-1] roundcube security update
Date:
             
 
Tue, 17 Feb 2026 12:50:38 +0100
Message-ID:
             
 
<aZRWDjgJrtieQPMl@debian.org>
-------------------------------------------------------------------------
Debian LTS Advisory DLA-4480-1                debian-lts@lists.debian.org
https://www.debian.org/lts/security/                       Guilhem Moulin
February 17, 2026                             https://wiki.debian.org/LTS
-------------------------------------------------------------------------

Package        : roundcube
Version        : 1.4.15+dfsg.1-1+deb11u7
CVE ID         : CVE-2026-25916 CVE-2026-26079
Debian Bug     : 1127447

Vulnerabilities were discovered in Roundcube, a skinnable AJAX based
webmail solution for IMAP servers, which might lead to information
disclosure or privilege escalation.

CVE-2026-25916

    NULL CATHEDRAL discovered that the HTML sanitizer doesn't treat SVG
    `<feImage href="…">` as an image source.  This allows attackers to
    bypass remote image blocking to track email open action or
    potentially bypass access control.

CVE-2026-26079

    CERT Polska discovered that CSS code in text/html emails were
    insufficiently sanitized, allowing an attacker to inject malicious
    stylesheet rules.

For Debian 11 bullseye, these problems have been fixed in version
1.4.15+dfsg.1-1+deb11u7.

We recommend that you upgrade your roundcube packages.

For the detailed security status of roundcube please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/roundcube

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS


Attachment: signature.asc (type=application/pgp-signature)
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEERpy6p3b9sfzUdbME05pJnDwhpVIFAmmUVgsACgkQ05pJnDwh
pVKRlxAAw2/1YrsRPT8I8Y/WAdOXDNnyZIi5PDcRLPCKxgrF2vM2EpaS8K/ZWjmQ
oyhDQABaD8zPk6vbthN/8oRHXbL4a1C2FPDbOTcVD8RtiWRi9oe0zTGDAb7+TDuu
tfhJkHuEZNm9Ahje7vP3rS5HYwfiprQ36U9MfhlDtNRq/IE35IuPUMLB5ITufB8d
lnWWAW+5x1nIYIsQRKdWWfNjZVTQmpY8SK5fSEr6Db+lx/o3XAFM7r+6u7yQZLQV
TZbD81aH/24oG8f5zxbopQQmFIiZ1NDlcw+H3Z5VX4+fEIhdfaxQNVy8pTWPD++D
L8e6s3Zl2XUpYAaKiQfVeoInCgQC5Xya3X30GbcAm61WXpkO3n6M2scLJLSm6qMV
CwU0qtzwGCrPU6vaDgfsBMD59LPhQm52i9dR68kOUoAxdBoeEZequFf3c668g3DA
VIeTgu5wcJM3wUBFaEcePfwXLDo8U4ockM7BvRz74DXgWzPqClOc32iwaQaCwcdf
KCw+pH9GbOgZawzIcv+a5z8Hj3W7HAk3eaam9naTuvMDK7B/wB3BSQd22IdzRl7A
zd9GF/qmbDuX9zPtNxJOezkz2rEGDmBePWniAzppOAgFDVfZNSOq15pT37uU3DyA
VcwOlNsqQR7xhZM5Qb5vP747/Vv3bzXlEY5sl8MzS65TU5Td5EM=
=G1qa
-----END PGP SIGNATURE-----