Fedora Security Advisories

Patch release for security advisory CVE-2026-32711. A crafted DICOMDIR could create a path traversal by setting ReferencedFileID to a path outside the File-set root.

python-pydicom-3.0.2-1.fc44

6 days 15 hours ago

FEDORA-2026-9eecdef4e0 Packages in this update:

python-pydicom-3.0.2-1.fc44

Update description:

Patch release for security advisory CVE-2026-32711. A crafted DICOMDIR could create a path traversal by setting ReferencedFileID to a path outside the File-set root.

roundcubemail-1.7~rc6-1.fc44

Fedora Security Advisories

6 days 17 hours ago

FEDORA-2026-6d293b6889 Packages in this update:

roundcubemail-1.7~rc6-1.fc44

Update description:

Version 1.7-rc6

This is hopefully the last release candidate for the next major version 1.7 of Roundcube Webmail. It provides a fix to recently reported security vulnerability:

SVG Animate FUNCIRI Attribute Bypass — Remote Image Loading via fill/filter/stroke, reported by class_nzm.

We believe it is production ready, but we recommend to test it on a separate environment.

Migrate existing configs with either the installto.sh or the update.sh scripts.

And don't forget to backup your data before installing it!

CHANGELOG

Added support for arrays in smtp_user and smtp_pass config options (#10083)
Added system health checker CLI script (#10106)
Stricter recognition of an Ajax request (#10118)
Password: Added Stalwart driver (#10114)
Fix regression where some data url images could get ignored/lost (#10128)
Fix SVG Animate FUNCIRI Attribute Bypass — Remote Image Loading via fill/filter/stroke

roundcubemail-1.6.15-1.el10_2

Fedora Security Advisories

6 days 17 hours ago

FEDORA-EPEL-2026-646aebe990 Packages in this update:

roundcubemail-1.6.15-1.el10_2

Update description:

Version 1.6.15

This is a security update to the stable version 1.6 of Roundcube Webmail. It provides fixes to some regressions introduced in the previous release as well a recently reported security vulnerability:

SVG Animate FUNCIRI Attribute Bypass — Remote Image Loading via fill/filter/stroke, reported by class_nzm.

This version is considered stable and we recommend to update all productive installations of Roundcube 1.6.x with it. Please do backup your data before updating!

CHANGELOG

Fix regression where mail search would fail on non-ascii search criteria (#10121)
Fix regression where some data url images could get ignored/lost (#10128)
Fix SVG Animate FUNCIRI Attribute Bypass — Remote Image Loading via fill/filter/stroke

roundcubemail-1.6.15-1.fc42

Fedora Security Advisories

6 days 17 hours ago

FEDORA-2026-051825ca18 Packages in this update:

roundcubemail-1.6.15-1.fc42

Update description:

Version 1.6.15

This is a security update to the stable version 1.6 of Roundcube Webmail. It provides fixes to some regressions introduced in the previous release as well a recently reported security vulnerability:

SVG Animate FUNCIRI Attribute Bypass — Remote Image Loading via fill/filter/stroke, reported by class_nzm.

This version is considered stable and we recommend to update all productive installations of Roundcube 1.6.x with it. Please do backup your data before updating!

CHANGELOG

Fix regression where mail search would fail on non-ascii search criteria (#10121)
Fix regression where some data url images could get ignored/lost (#10128)
Fix SVG Animate FUNCIRI Attribute Bypass — Remote Image Loading via fill/filter/stroke

roundcubemail-1.6.15-1.el10_1

Fedora Security Advisories

6 days 17 hours ago

FEDORA-EPEL-2026-82b702d826 Packages in this update:

roundcubemail-1.6.15-1.el10_1

Update description:

Version 1.6.15

This is a security update to the stable version 1.6 of Roundcube Webmail. It provides fixes to some regressions introduced in the previous release as well a recently reported security vulnerability:

SVG Animate FUNCIRI Attribute Bypass — Remote Image Loading via fill/filter/stroke, reported by class_nzm.

This version is considered stable and we recommend to update all productive installations of Roundcube 1.6.x with it. Please do backup your data before updating!

CHANGELOG

Fix regression where mail search would fail on non-ascii search criteria (#10121)
Fix regression where some data url images could get ignored/lost (#10128)
Fix SVG Animate FUNCIRI Attribute Bypass — Remote Image Loading via fill/filter/stroke

roundcubemail-1.6.15-1.el10_3

Fedora Security Advisories

6 days 17 hours ago

FEDORA-EPEL-2026-f7a0d90857 Packages in this update:

roundcubemail-1.6.15-1.el10_3

Update description:

Version 1.6.15

This is a security update to the stable version 1.6 of Roundcube Webmail. It provides fixes to some regressions introduced in the previous release as well a recently reported security vulnerability:

SVG Animate FUNCIRI Attribute Bypass — Remote Image Loading via fill/filter/stroke, reported by class_nzm.

This version is considered stable and we recommend to update all productive installations of Roundcube 1.6.x with it. Please do backup your data before updating!

CHANGELOG

Fix regression where mail search would fail on non-ascii search criteria (#10121)
Fix regression where some data url images could get ignored/lost (#10128)
Fix SVG Animate FUNCIRI Attribute Bypass — Remote Image Loading via fill/filter/stroke

roundcubemail-1.6.15-1.fc43

Fedora Security Advisories

6 days 17 hours ago

FEDORA-2026-8ba1a085a9 Packages in this update:

roundcubemail-1.6.15-1.fc43

Update description:

Version 1.6.15

This is a security update to the stable version 1.6 of Roundcube Webmail. It provides fixes to some regressions introduced in the previous release as well a recently reported security vulnerability:

SVG Animate FUNCIRI Attribute Bypass — Remote Image Loading via fill/filter/stroke, reported by class_nzm.

This version is considered stable and we recommend to update all productive installations of Roundcube 1.6.x with it. Please do backup your data before updating!

CHANGELOG

Fix regression where mail search would fail on non-ascii search criteria (#10121)
Fix regression where some data url images could get ignored/lost (#10128)
Fix SVG Animate FUNCIRI Attribute Bypass — Remote Image Loading via fill/filter/stroke

roundcubemail-1.5.15-1.el9

Fedora Security Advisories

6 days 17 hours ago

FEDORA-EPEL-2026-bf73d904ba Packages in this update:

roundcubemail-1.5.15-1.el9

Update description:

Version 1.5.15

This is a security update to the stable version 1.5 of Roundcube Webmail. It provides fixes to some regressions introduced in the previous release as well a recently reported security vulnerability:

SVG Animate FUNCIRI Attribute Bypass — Remote Image Loading via fill/filter/stroke, reported by class_nzm.

This version is considered stable and we recommend to update all productive installations of Roundcube 1.5.x with it. Please do backup your data before updating!

CHANGELOG

Fix so distribution packages (and composer.json) don't include development dependencies
Fix regression where mail search would fail on non-ascii search criteria (#10121)
Fix regression where some data url images could get ignored/lost (#10128)
Fix SVG Animate FUNCIRI Attribute Bypass — Remote Image Loading via fill/filter/stroke