Ubuntu alert USN-8482-1 (roundcube)

From:
             
 
noreply+usn-bot--- via ubuntu-security-announce <ubuntu-security-announce@lists.ubuntu.com>
To:
             
 
ubuntu-security-announce@lists.ubuntu.com
Subject:
             
 
[USN-8482-1] Roundcube Webmail vulnerability
Date:
             
 
Tue, 30 Jun 2026 09:28:22 +0000
Message-ID:
             
 
<E1weUlS-0002cK-CE@lists.ubuntu.com>
Cc:
             
 
noreply+usn-bot@canonical.com
==========================================================================
Ubuntu Security Notice USN-8482-1
June 30, 2026

roundcube vulnerability
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 26.04 LTS

Summary:

Roundcube Webmail could be made to run programs as your login if it opened
a malicious website.

Software Description:
- roundcube: skinnable AJAX based webmail solution for IMAP servers - metapack 

Details:

It was discovered that Roundcube Webmail was prone to a Cross-Site-Scripting
(XSS) vulnerability via the animate tag in an SVG document. An attacker
could use this issue to execute arbitrary web script in the context of an 
affected user's session.

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 26.04 LTS
  roundcube                       1.6.11+dfsg-1ubuntu0.26.04.1~esm1
                                  Available with Ubuntu Pro
  roundcube-core                  1.6.11+dfsg-1ubuntu0.26.04.1~esm1
                                  Available with Ubuntu Pro

In general, a standard system update will make all the necessary changes.

References:
  https://ubuntu.com/security/notices/USN-8482-1
  CVE-2025-68461


Attachment: signature.asc (type=application/pgp-signature)
-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEE+8neBLO2Hp/ppPlOcpJm3tlzhgEFAmpDi3cACgkQcpJm3tlz
hgHJuQ//dRhVloTyWOgmqefJp8qTw8gVeyauRP9i+cfj1eZFknEZ/ZRTbbXFtCC8
KRgC5ygjB3IFyKNCKNTNGg/R7lAodK8hmzHvdBNpz8SFqZc3dQ2JvHC3uUqb2pQI
EimKtDlCP4J0CG/KgHuWxOC75r3BKWbkaMOV6dgj8zudWcFV8oIvrbz28YPodrOo
HceejONn38XLynpzCqOXpySxjxa5FH0ZBj1J7Ik749jzIEesX2a5BQ9J9UP3VdmF
Q4pUdEAtiLq1Xz/puM1yywryIBZaft91tmlkQvHE7V6vLaLGiK3PcHtLZARUYzWj
evah44iExibziqG76g5oRK+LPyzlBtlgs3nEk3unFr7MX3LoQtPyQWVUi1JsPJxT
kLguR1GRBf6uCVwc21e7lqet0Uqb8++oJp2xlC8BReKPDeuCfFkcUsoWxVDwtJwv
h8ujsFkK2PP3zyCxKUAS0VcVPbX0q9w6JKY7Suc/gGiFObGPhm38fmXOo+lkjfKQ
krLbPxXq21wGg+4FwAWnqMHRHfpgHQEns+7HbRWI+IMEMWECNILuipJaM8SMridR
LfJPhwd4uXvMVBzIyblyr5TgL37oz9gAYIej1SEN6HKXEreXBPjJ/8y0nDrerH9V
yb/FZEA7fcm6RMTR3rg4dFQECy8Cuu/kFyeB6HUXUUMmdCRhrV8=
=oVox
-----END PGP SIGNATURE-----