Mageia alert MGASA-2023-0332 (roundcubemail)

From:
             
 
Mageia Updates <buildsystem-daemon@mageia.org>
To:
             
 
updates-announce@ml.mageia.org
Subject:
             
 
[updates-announce] MGASA-2023-0332: Updated roundcubemail packages fix XSS security vulnerabilities
Date:
             
 
Fri, 01 Dec 2023 12:56:37 +0100
Message-ID:
             
 
<20231201115637.4C9E69FABB@duvel.mageia.org>
Archive-link:
             
 
Article
MGASA-2023-0332 - Updated roundcubemail packages fix XSS security vulnerabilities

Publication date: 01 Dec 2023
URL: https://advisories.mageia.org/MGASA-2023-0332.html
Type: security
Affected Mageia releases: 9
CVE: CVE-2023-5631,
     CVE-2023-47272

Description:
Updated roundcubemail package fixes security vulnerabilities:

Fix cross-site scripting (XSS) vulnerability in setting Content-Type/
Content-Disposition for attachment preview/download (CVE-2023-47272)

Fix cross-site scripting (XSS) vulnerability in handling of SVG in HTML
messages. (CVE-2023-5631)

Some other errors have been fixed:
- Fix PHP8 fatal error when parsing a malformed BODYSTRUCTURE
- Fix duplicated Inbox folder on IMAP servers that do not use Inbox
  folder with all capital letters
- Fix PHP warnings
- Fix UI issue when dealing with an invalid managesieve_default_headers
  value
- Fix bug where images attached to application/smil messages weren't
  displayed
- Fix PHP string replacement error in utils/error.php
- Fix regression where smtp_user did not allow pre/post strings
  before/after %u placeholder

References:
- https://bugs.mageia.org/show_bug.cgi?id=32493
- https://github.com/roundcube/roundcubemail/releases/tag/1...
- https://github.com/roundcube/roundcubemail/releases/tag/1...
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-5631
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-4...

SRPMS:
- 9/core/roundcubemail-1.6.5-1.mga9