Summary
Ein Angreifer kann mehrere Schwachstellen in Roundcube Webmail ausnutzen, um beliebigen Programmcode auszuführen, erweiterte Berechtigungen zu erlangen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren oder offenzulegen oder Cross-Site-Scripting-Angriffe durchzuführen.
Product
Roundcube ist ein Open-Source Webmailsystem, basierend auf PHP.
Vulnerabilities 10
-
High 8.8
In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the cmd_learn driver of the markasjunk plugin is subject to …
-
High 7.2
In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, responses from the CSS (Cascading Style Sheets) proxy were n…
-
High 7.1
In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, mail search and LITERAL+ byte-count desynchronization could …
-
Medium 6.4
In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the modoboa driver of the password plugin could leak a Modob…
-
Medium 5.8
In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, improper HTML/CSS sanitization of the SVG animate "by" attri…
-
Medium 5.8
In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, an unclosed url() in a FuncIRI attribute of an SVG image cou…
-
Medium 5.8
In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, insufficient Cascading Style Sheets (CSS) sanitization in HT…
-
Medium 5.4
In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the "Add to address book" action was subject to stored XSS.
-
Medium 5.4
In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the LDAP search filter was subject to injection via unescape…
-
Medium 4.3
In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, improper rule name quoting could lead to managesieve_disable…
Revision history
-
#5
Neue Updates von openSUSE aufgenommen
-
#4
Neue Updates von openSUSE aufgenommen
-
#3
Neue Updates von Debian aufgenommen
-
#2
Neue Updates von Debian aufgenommen
-
#1
Initiale Fassung
References
-
Roundcube Webmail Security Updates 1.6.18 and 1.7.3 vom 2026-08-17
https://roundcube.net/news/2026/08/09/security-updates-1.6.18-and-1.7.3
-
Debian Security Advisory DLA-4760 vom 2026-08-29
https://lists.debian.org/debian-lts-announce/2026/08/msg00051.html
-
Debian Security Advisory DSA-6479 vom 2026-08-30
https://security-tracker.debian.org/tracker/DSA-6479-1
-
Debian Security Advisory DLA-4823 vom 2026-10-05
https://lists.debian.org/debian-lts-announce/2026/10/msg00015.html
-
openSUSE Security Update OPENSUSE-SU-2026:0361-1 vom 2026-10-29
https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/TIHQXAVDKF5E53CSRZASN2PMF3CXEORP/
-
openSUSE Security Update OPENSUSE-SU-2026:22195-1 vom 2026-10-31
https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/J3EVNRCCEZEFVA24W2SWDKEIJHRKIQ5Q/
-
openSUSE Security Update OPENSUSE-SU-2026:12169-1 vom 2026-10-30
https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/OPRYR7NQAXW2AA2X6PU2GM76EV2F6BCV/