SUSE alert openSUSE-SU-2026:0183-1 (roundcubemail)
| From: | maintenance@opensuse.org | |
| To: | security-announce@lists.opensuse.org | |
| Subject: | openSUSE-SU-2026:0183-1: important: Security update for roundcubemail | |
| Date: | Fri, 12 Jun 2026 03:13:19 +0200 | |
| Message-ID: | <20260612011319.E7109F799@maintenance.suse.de> | |
| Archive-link: | Article |
openSUSE Security Update: Security update for roundcubemail ______________________________________________________________________________ Announcement ID: openSUSE-SU-2026:0183-1 Rating: important References: #1266329 #1266331 #1266332 #1266333 #1266334 #1266335 #1266336 #1266337 Cross-References: CVE-2026-48842 CVE-2026-48843 CVE-2026-48844 CVE-2026-48845 CVE-2026-48846 CVE-2026-48847 CVE-2026-48848 CVE-2026-48849 Affected Products: openSUSE Backports SLE-15-SP6 openSUSE Backports SLE-15-SP7 ______________________________________________________________________________ An update that fixes 8 vulnerabilities is now available. Description: This update for roundcubemail fixes the following issues: Update to 1.6.16 - Fix potential too long value in IMAP ID command (#10136) - CVE-2026-48849: Fix stored XSS/HTML/CSS injection in subject field of the draft restore dialog [boo#1266337] - CVE-2026-48848: Fix CSS injection bypass in HTML sanitizer via SVG <animate attributeName="style"> [boo#1266336] - CVE-2026-48842: Fix pre-auth SQL injection in virtuser_query plugin via preg_replace backslash escape bypass [boo#1266329] - CVE-2026-48843: Fix SSRF bypass via specific local address URLs [boo#1266331] - CVE-2026-48846: Fix bypass of remote image blocking via CSS var() [boo#1266334] - CVE-2026-48845: Fix local/private URL fetch bypass when remote resources were not allowed [boo#1266333] - CVE-2026-48847: Fix pre-auth arbitrary file delete via redis/memcache session poisoning bypass [boo#1266335] - CVE-2026-48844: Fix code injection vulnerability - remove support for code evaluation in LDAP autovalues option [boo#1266332] Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP7: zypper in -t patch openSUSE-2026-183=1 - openSUSE Backports SLE-15-SP6: zypper in -t patch openSUSE-2026-183=1 Package List: - openSUSE Backports SLE-15-SP7 (noarch): roundcubemail-1.6.16-bp157.2.12.1 - openSUSE Backports SLE-15-SP6 (noarch): roundcubemail-1.6.16-bp156.2.18.1 References: https://www.suse.com/security/cve/CVE-2026-48842.html https://www.suse.com/security/cve/CVE-2026-48843.html https://www.suse.com/security/cve/CVE-2026-48844.html https://www.suse.com/security/cve/CVE-2026-48845.html https://www.suse.com/security/cve/CVE-2026-48846.html https://www.suse.com/security/cve/CVE-2026-48847.html https://www.suse.com/security/cve/CVE-2026-48848.html https://www.suse.com/security/cve/CVE-2026-48849.html https://bugzilla.suse.com/1266329 https://bugzilla.suse.com/1266331 https://bugzilla.suse.com/1266332 https://bugzilla.suse.com/1266333 https://bugzilla.suse.com/1266334 https://bugzilla.suse.com/1266335 https://bugzilla.suse.com/1266336 https://bugzilla.suse.com/1266337