Debian alert DLA-4604-1 (roundcube)

From:
             
 
Guilhem Moulin <guilhem@debian.org>
To:
             
 
debian-lts-announce@lists.debian.org
Subject:
             
 
[SECURITY] [DLA 4604-1] roundcube security update
Date:
             
 
Thu, 28 May 2026 15:18:47 +0200
Message-ID:
             
 
<ahhAt6uc1xQYRsuL@debian.org>
-------------------------------------------------------------------------
Debian LTS Advisory DLA-4604-1                debian-lts@lists.debian.org
https://www.debian.org/lts/security/                       Guilhem Moulin
May 28, 2026                                  https://wiki.debian.org/LTS
-------------------------------------------------------------------------

Package        : roundcube
Version        : 1.4.15+dfsg.1-1+deb11u9
CVE ID         : CVE-2026-48842 CVE-2026-48843 CVE-2026-48844 CVE-2026-48845 
                 CVE-2026-48846 CVE-2026-48847 CVE-2026-48848 CVE-2026-48849
Debian Bug     : 1132838 1137507

Multiple vulnerabilities were discovered in Roundcube, a skinnable AJAX
based webmail solution for IMAP servers, which could result in
cross-site scripting, SQL injection, server-side request forgery,
information disclosure, code injection, or deletion of arbitrary files.

CVE-2026-48842

    Pre-authentication SQL injection in `virtuser_query` plugin via
    `preg_replace()` backslash escape bypass.

CVE-2026-48843

   Server-Side Request Forgery (SSRF) vulnerability via stylesheet links
   to a specific local address URLs.  This issues stems from an
   insufficient fix for CVE-2026-35540.

CVE-2026-48844

    Code injection vulnerability via code evaluation support in LDAP's
    `autovalues` option.  Code evaluation support has been removed in
    this update.

CVE-2026-48845

    Local/private URL fetch bypass when remote resources were not
    allowed.  This allows attackers to bypass remote image blocking to
    potentially bypass access control.

CVE-2026-48846

    Bypass of remote image blocking via CSS `var()`.  This allows
    attackers to bypass remote image blocking to track email open action
    or potentially bypass access control.

CVE-2026-48847

    Pre-authentication arbitrary file delete via redis/memcache session
    poisoning bypass.

CVE-2026-48848

    CSS injection bypass in HTML sanitizer via SVG `<animate
    attributeName="style">`.

CVE-2026-48849

    Stored XSS/HTML/CSS injection in subject field of the draft restore
    dialog.

For Debian 11 bullseye, these problems have been fixed in version
1.4.15+dfsg.1-1+deb11u9.

We recommend that you upgrade your roundcube packages.

For the detailed security status of roundcube please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/roundcube

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS


Attachment: signature.asc (type=application/pgp-signature)
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEERpy6p3b9sfzUdbME05pJnDwhpVIFAmoYQLcACgkQ05pJnDwh
pVK3QA//c2zqXoHQgNfgse5FKebj7bApD3U4Re8c3F0Yf6LDQwOEPtvYVLmA8HA1
DudOLTA9fDAgCodwympw9tnkV8t0UcBGok4M7A/2wgSKgwWcmnYXNTAy/aZhqSgV
YnYyQEsP1HA6lA50lzF+/PkNSkU5U4x6UHzBQ768fhD2QZK8zoDbwzjLjfYJ4XKO
tflWBvNhQx6D8JlMVNEjpB/x778fsr/MhDMZGaB10vkFB4/aYcJxc2aMJS9ZTeZo
i2yjKYYD2TYI+OkX6ynUCrCjdd17JGtRDHfc4/htqJybuEluxjc3CM0IQmDy49ZB
E6SbSFg47w2IrK0IRiY8IIA1HXvRzy6J/HDVxwhnLQ73SY7exwArT75KQAU7Vf2g
ZAKODJZDQhUtwL3DHaOU3SqVJTSjIOd7xwfsDrHFmjdpnAi3lGCy41kvYGX4x5Jj
8Yk1ueFTeUG1g2ckCgW99BHdGDI2FLjk7A2lEeLWC9v+c/2C7r8rQNCy63blWwtG
WHBB6mBfjvLTjsCQmXcOeYgpazc5EvQ2GIFbRZxAg8TFtC6+E1u9KOaX4B6+k7Vz
YAE6Eb2Q7thURT8x3+/s1wGOv1DutkL7uC+CRvpJRMTccv3Ao6tyCYLhZ3PGjCkN
nShHsFG6PjZ0cdtZ6eefZVqUMwMv1icuW50eSnc+IKMVCv41aUM=
=aOH9
-----END PGP SIGNATURE-----