Debian alert DLA-4693-1 (roundcube)

From:
             
 
Guilhem Moulin <guilhem@debian.org>
To:
             
 
debian-lts-announce@lists.debian.org
Subject:
             
 
[SECURITY] [DLA 4693-1] roundcube security update
Date:
             
 
Wed, 22 Jul 2026 02:48:25 +0200
Message-ID:
             
 
<amATV4Q4C2NMApu7@debian.org>
-------------------------------------------------------------------------
Debian LTS Advisory DLA-4693-1                debian-lts@lists.debian.org
https://www.debian.org/lts/security/                       Guilhem Moulin
July 22, 2026                                 https://wiki.debian.org/LTS
-------------------------------------------------------------------------

Package        : roundcube
Version        : 1.4.15+dfsg.1-1+deb11u10 1.6.5+dfsg-1+deb12u10
CVE ID         : CVE-2026-54432 CVE-2026-54433 CVE-2026-62641 CVE-2026-62642 
                 CVE-2026-62643 CVE-2026-62644
Debian Bug     : 1138086 1141495

Multiple vulnerabilities were discovered in Roundcube, a skinnable AJAX
based webmail solution for IMAP servers, which could result in
cross-site scripting, server-side request forgery, information
disclosure, denial of service, or potentially account takeover.

CVE-2026-54432

    Bohdan Kurinnoy discovered that attachment MIME types were neither
    sanitized nor escaped on the attachment-validation warning page,
    yielding a stored XSS vulnerability.

CVE-2026-54433

    Bohdan Kurinnoy discovered that plain-text rendering was subject to
    a zero-click stored XSS vulnerability via crafted mailto: URIs.

CVE-2026-62641

    It was discovered that the TNEF decoder was subject to Denial of
    Service via crafted compressed-RTF size in the winmail.dat
    attachment file.

CVE-2026-62642

    An infinite loop was discovered in the TNEF decoder, which may lead
    to denial of service upon opening an email with a TNEF attachment.

CVE-2026-62643

    It was discovered that the CSS sanitization fixes for CVE-2026-35540 and
    CVE-2026-48843 were insufficient, allowing a malicious embedded
    stylesheet in an HTML email to lead to SSRF or information
    disclosure.

CVE-2026-62644

    It was discovered that the password plugin was subject to username
    spoofing via session data, which could potentially lead to account
    takeover.

For Debian 11 bullseye, these problems have been fixed in version
1.4.15+dfsg.1-1+deb11u10.

For Debian 12 bookworm, these problems have been fixed in version
1.6.5+dfsg-1+deb12u10.

We recommend that you upgrade your roundcube packages.

For the detailed security status of roundcube please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/roundcube

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS


Attachment: signature.asc (type=application/pgp-signature)
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEERpy6p3b9sfzUdbME05pJnDwhpVIFAmpgE1cACgkQ05pJnDwh
pVIQ5A//W4QT/QzgRXSFcKFLKIaGWq9QYXl5FN/+m9fiw31aDSN1KBEAfum94pIn
1x01wi/9ZpTzndWeNBY1kMu1fODkuGgqIo3JI5W19SDFlZ4aLLoPbasSqoASQJUS
iUvACV62tdJsfwa0PJHUtbxYYNkcRHOVIJW0Yg6TU8p4pCmiwILy0SmFgvBi35Rf
AuAphjEwozGPD9BpmsubQTaptAtNtHt5y+itgrDbcIV/roW0KQBWqiFYJc6qKQIJ
I931rNpnKeWKnwT05suE+5Ucny98ZDkvKmaz+Id1+ke2Bbob384xWAQCZrTJVhD0
g8fISr+TNcM4Oadk+O83/OwyJBcY0+Xc8NUM3ILZ1Tl+SLZyl3mXyL4oakDUCHAq
/rhCvLkWE/AaixV36PzM/gyGmygx+J2gi4jv4b+zxZ86omP+7VnGrdq3a6othQLy
Z4uM2tqONRSfFt4nsde1VgS5N1mTN6IgMUQcLVk7hrsuhnPRmMSCLRBvB5+Opsuo
3fDcgbLMhUwW5TxFD/30jcggP8npzir2xr53jEhY16E0/sn0F0trYtQAJYzGRwfY
/xui3J6PTb/rPRGlzBC+0MxTv8Sr5UthngkUfF+nszrJuLgn6d+fFAwfbqfYdDsO
2xO5vVTOzvTqhRUM4p6npFR5B/pfWlxJIoua2CSAvSxMzRcrY5g=
=7lkZ
-----END PGP SIGNATURE-----