Fedora Security Advisories

Password: Fix fatal error "Class 'Zxcvbn' not found" (#10274)
Fix out-of-bounds string reads on truncated compressed-RTF in the TNEF decoder (#10269)
Security: Add basic validation for content proxied by the css proxy
Security: Fix SSRF bypass via specific local address URLs using 100.64.0.0/10 and fe80::/10 nets
Security: Fix SSRF filter bypass via various forms of nip.io/sslip.io hostnames evading is_local_url() check
Security: Fix remote content blocking bypass via unclosed url() in a FuncIRI attribute
Security: Fix LDAP filter injection via unescaped %u/%fu/%d substitution into the search_filter
Security: Fix arbitrary Sieve script injection via a filter rule name bypassing managesieve_disabled_actions
Security: Fix RCE via cmd_learn driver of markasjunk plugin
Security: Fix IMAP command injection via mail search and LITERAL+ byte-count desynchronization
Security: Fix password's modoboa driver leak of an authentication token to a user-controlled host
Security: Fix stored XSS in "Add to address book" action
Security: Fix HTML/CSS sanitization bypass via SVG animate by attribute

roundcubemail-1.6.18-1.el10_3

22 hours 27 minutes ago

FEDORA-EPEL-2026-c09c342945 Packages in this update:

roundcubemail-1.6.18-1.el10_3

Update description: Release 1.6.18

Password: Fix fatal error "Class 'Zxcvbn' not found" (#10274)
Fix out-of-bounds string reads on truncated compressed-RTF in the TNEF decoder (#10269)
Security: Add basic validation for content proxied by the css proxy
Security: Fix SSRF bypass via specific local address URLs using 100.64.0.0/10 and fe80::/10 nets
Security: Fix SSRF filter bypass via various forms of nip.io/sslip.io hostnames evading is_local_url() check
Security: Fix remote content blocking bypass via unclosed url() in a FuncIRI attribute
Security: Fix LDAP filter injection via unescaped %u/%fu/%d substitution into the search_filter
Security: Fix arbitrary Sieve script injection via a filter rule name bypassing managesieve_disabled_actions
Security: Fix RCE via cmd_learn driver of markasjunk plugin
Security: Fix IMAP command injection via mail search and LITERAL+ byte-count desynchronization
Security: Fix password's modoboa driver leak of an authentication token to a user-controlled host
Security: Fix stored XSS in "Add to address book" action
Security: Fix HTML/CSS sanitization bypass via SVG animate by attribute

roundcubemail-1.6.18-1.fc43

Fedora Security Advisories

22 hours 27 minutes ago

FEDORA-2026-914a40b4fd Packages in this update:

roundcubemail-1.6.18-1.fc43

Update description: Release 1.6.18

Password: Fix fatal error "Class 'Zxcvbn' not found" (#10274)
Fix out-of-bounds string reads on truncated compressed-RTF in the TNEF decoder (#10269)
Security: Add basic validation for content proxied by the css proxy
Security: Fix SSRF bypass via specific local address URLs using 100.64.0.0/10 and fe80::/10 nets
Security: Fix SSRF filter bypass via various forms of nip.io/sslip.io hostnames evading is_local_url() check
Security: Fix remote content blocking bypass via unclosed url() in a FuncIRI attribute
Security: Fix LDAP filter injection via unescaped %u/%fu/%d substitution into the search_filter
Security: Fix arbitrary Sieve script injection via a filter rule name bypassing managesieve_disabled_actions
Security: Fix RCE via cmd_learn driver of markasjunk plugin
Security: Fix IMAP command injection via mail search and LITERAL+ byte-count desynchronization
Security: Fix password's modoboa driver leak of an authentication token to a user-controlled host
Security: Fix stored XSS in "Add to address book" action
Security: Fix HTML/CSS sanitization bypass via SVG animate by attribute

roundcubemail-1.7.3-1.fc44

Fedora Security Advisories

22 hours 40 minutes ago

FEDORA-2026-2aa96a9ce5 Packages in this update:

roundcubemail-1.7.3-1.fc44

Update description: Release 1.7.3

OAuth: Don't log an error when a refreshed token's TTL is below refresh_interval (#10213)
Fix out-of-bounds string reads on truncated compressed-RTF in the TNEF decoder (#10269)
Fix bug where searching in example_addressbook plugin was reporting zero results despite matches (#9022)
Fix vCard import mis-detecting folded continuation lines as BEGIN/END:VCARD (#9593)
Fix bug where the php session driver practically disabled session.lazy_write optimization (#9885, #10248)
Fix bug where dates could get displayed shifted back one day in some places (#9403)
Fix regression where it wasn't possible to hide a skin logo image anymore (#10254)
Fix decoding of multi-segment RFC2231 extended attachment filenames (#10268)
Fix vCard import silently dropping properties with a non-item group prefix (#10271)
Fix so REQUEST_URI is used as a fallback if PATH_INFO is empty in static.php (#10181)
Security: Add basic validation for content proxied by the css proxy
Security: Fix SSRF bypass via specific local address URLs using 100.64.0.0/10 and fe80::/10 nets
Security: Fix SSRF filter bypass via various forms of nip.io/sslip.io hostnames evading is_local_url() check
Security: Fix remote content blocking bypass via unclosed url() in a FuncIRI attribute
Security: Fix LDAP filter injection via unescaped %u/%fu/%d substitution into the search_filter
Security: Fix arbitrary Sieve script injection via a filter rule name bypassing managesieve_disabled_actions
Security: Fix RCE via cmd_learn driver of markasjunk plugin
Security: Fix IMAP command injection via mail search and LITERAL+ byte-count desynchronization
Security: Fix password's modoboa driver leak of an authentication token to a user-controlled host
Security: Fix stored XSS in "Add to address book" action
Security: Fix HTML/CSS sanitization bypass via SVG animate by attribute