CVE-2020-12625

An issue was discovered in Roundcube Webmail before 1.4.4. There is a cross-site scripting (XSS) vulnerability in rcube_washtml.php because JavaScript code can occur in the CDATA of an HTML message.

An issue was discovered in Roundcube Webmail before 1.4.4. There is a cross-site scripting (XSS) vulnerability in rcube_washtml.php because JavaScript code can occur in the CDATA of an HTML message.

Updated roundcubemail packages fix security vulnerabilities:

• Cross-Site Scripting (XSS) via malicious HTML content (CVE-2020-12625)
• CSRF attack can cause an authenticated user to be logged out (CEV-2020-12626)
• Remote code execution via crafted config options
• Path traversal vulnerability allowing local file inclusion via crafted 'plugins' option

This update for roundcubemail fixes the following issues:

roundcubemail was upgraded to 1.3.15

This is a security update to the LTS version 1.3. (boo#1175135)

• Security: Fix cross-site scripting (XSS) via HTML messages with malicious svg content [CVE-2020-16145]
• Security: Fix cross-site scripting (XSS) via HTML messages with malicious math content

From 1.3.14 (boo#1173792 -> CVE-2020-15562)

• Security: Fix cross-site scripting (XSS) via HTML messages with malicious svg/namespace

From 1.3.13

• Installer: Fix regression in SMTP test section (#7417)

From 1.3.12

• Security: Better fix for CVE-2020-12641 (boo#1171148)
• Security: Fix XSS issue in template object 'username' (#7406)
• Security: Fix couple of XSS issues in Installer (#7406)
• Security: Fix cross-site scripting (XSS) via malicious XML attachment

From 1.3.11 (boo#1171148 -> CVE-2020-12641 boo#1171040 -> CVE-2020-12625 boo#1171149 -> CVE-2020-12640)

• Enigma: Fix compatibility with Mail_Mime >= 1.10.5
• Fix permissions on some folders created by bin/install-jsdeps.sh script (#6930)
• Fix bug where inline images could have been ignored if Content-Id header contained redundant spaces (#6980)
• Fix PHP Warning: Use of undefined constant LOG_EMERGE (#6991)
• Fix PHP warning: 'array_merge(): Expected parameter 2 to be an array, null given in sendmail.inc (#7003)
• Security: Fix XSS issue in handling of CDATA in HTML messages
• Security: Fix remote code execution via crafted 'im_convert_path' or 'im_identify_path' settings
• Security: Fix local file inclusion (and code execution) via crafted 'plugins' option
• Security: Fix CSRF bypass that could be used to log out an authenticated user (#7302)

From 1.3.10 (boo#1146286)

• Managesieve: Fix so 'Create filter' option does not show up when Filters menu is disabled (#6723)
• Enigma: Fix bug where revoked users/keys were not greyed out in key info
• Enigma: Fix error message when trying to encrypt with a revoked key (#6607)
• Enigma: Fix 'decryption oracle' bug [CVE-2019-10740] (#6638)
• Fix compatibility with kolab/net_ldap3 > 1.0.7 (#6785)
• Fix bug where bmp images couldn't be displayed on some systems (#6728)
• Fix bug in parsing vCard data using PHP 7.3 due to an invalid regexp (#6744)
• Fix bug where bold/strong text was converted to upper-case on html-to-text conversion (6758)
• Fix bug in rcube_utils::parse_hosts() where %t, %d, %z could return only tld (#6746)
• Fix bug where Next/Prev button in mail view didn't work with multi-folder search result (#6793)
• Fix bug where selection of columns on messages list wasn't working
• Fix bug in converting multi-page Tiff images to Jpeg (#6824)
• Fix wrong messages order after returning to a multi-folder search result (#6836)
• Fix PHP 7.4 deprecation: implode() wrong parameter order (#6866)
• Fix bug where it was possible to bypass the position:fixed CSS check in received messages (#6898)
• Fix bug where some strict remote URIs in url() style were unintentionally blocked (#6899)
• Fix bug where it was possible to bypass the CSS jail in HTML messages using :root pseudo-class (#6897)
• Fix bug where it was possible to bypass href URI check with data:application/xhtml+xml URIs (#6896)

From 1.3.9 (boo#1115718)

• Fix TinyMCE download location (#6694)
• Fix bug where a message/rfc822 part without a filename wasn't listed on the attachments list (#6494)
• Fix handling of empty entries in vCard import (#6564)
• Fix bug in parsing some IMAP command responses that include unsolicited replies (#6577)
• Fix PHP 7.2 compatibility in debug_logger plugin (#6586)
• Fix so ANY record is not used for email domain validation, use A, MX, CNAME, AAAA instead (#6581)
• Fix so mime_content_type check in Installer uses files that should always be available (i.e. from program/resources) (#6599)
• Fix missing CSRF token on a link to download too-big message part (#6621)
• Fix bug when aborting…

It was discovered that Roundcube Webmail allowed JavaScript code to be present in the CDATA of an HTML message. A remote attacker could possibly use this issue to execute a cross-site scripting (XSS) attack. This issue only affected Ubuntu 16.04 ESM, Ubuntu 18.04 ESM and Ubuntu 20.04 ESM. (CVE-2020-12625)

It was discovered that Roundcube Webmail incorrectly processed login and logout POST requests. An attacker could possibly use this issue to launch a cross-site request forgery (CSRF) attack and force an authenticated user to be logged out. This issue only affected Ubuntu 16.04 ESM, Ubuntu 18.04 ESM and Ubuntu 20.04 ESM. (CVE-2020-12626)

It was discovered that Roundcube Webmail incorrectly processed new plugin names in rcube_plugin_api.php. An attacker could possibly use this issue to obtain sensitive information from local files or to execute arbitrary code. This issue only affected Ubuntu 16.04 ESM, Ubuntu 18.04 ESM and Ubuntu 20.04 ESM. (CVE-2020-12640)

It was discovered that Roundcube Webmail did not sanitize shell metacharacters recovered from variables in its configuration settings. An attacker could possibly use this issue to execute arbitrary code in the server. This issue only affected Ubuntu 16.04 ESM, Ubuntu 18.04 ESM and Ubuntu 20.04 ESM. (CVE-2020-12641)

It was discovered that Roundcube Webmail incorrectly sanitized characters in the username template object. An attacker could possibly use this issue to execute a cross-site scripting (XSS) attack. This issue only affected Ubuntu 16.04 ESM, Ubuntu 18.04 ESM and Ubuntu 20.04 ESM. (CVE-2020-13964)

It was discovered that Roundcube Webmail allowed preview of text/html content. A remote attacker could possibly use this issue to send a malicious XML attachment via an email message and execute a cross-site scripting (XSS) attack. This issue only affected Ubuntu 16.04 ESM, Ubuntu 18.04 ESM and Ubuntu 20.04 ESM. (CVE-2020-13965)

Andrea Cardaci discovered that Roundcube Webmail did not properly sanitize HTML special characters when dealing with HTML messages that contained an SVG element in the XML namespace. A remote attacker could possibly use this issue to execute a cross-site scripting (XSS) attack. This issue only affected Ubuntu 18.04 ESM and Ubuntu 20.04 ESM. (CVE-2020-15562)

Lukasz Pilorz discovered that Roundcube Webmail did not properly sanitize HTML special characters when dealing with HTML messages that contained SVG documents. A remote attacker could possibly use this issue to execute a cross-site scripting (XSS) attack. This issue only affected Ubuntu 18.04 ESM and Ubuntu 20.04 ESM. (CVE-2020-16145)

Alex Birnberg discovered that Roundcube Webmail incorrectly sanitized characters in plain text e-mail messages that included link reference elements. A remote attacker could possibly use this issue to execute a cross-site scripting (XSS) attack. This issue only affected Ubuntu 16.04 ESM, Ubuntu 18.04 ESM and Ubuntu 20.04 ESM. (CVE-2020-35730)

It was discovered that Roundcube Webmail did not properly sanitize HTML special characters in warning messages that contained an attachment's filename extension. A remote attacker could possibly use this issue to execute a cross-site scripting (XSS) attack. This issue only affected Ubuntu 16.04 ESM, Ubuntu 18.04 ESM and Ubuntu 20.04 ESM. (CVE-2021-44025)

It was discovered that Roundcube Webmail incorrectly managed session variables related to search functionalities. A remote attacker could possibly use this issue to execute a SQL injection attack. This issue only affected Ubuntu 16.04 ESM, Ubuntu 18.04 ESM and Ubuntu 20.04 ESM. (CVE-2021-44026)

It was discovered that Roundcube Webmail did not properly sanitize HTML special characters when dealing with HTML messages that contained CSS content. A remote attacker could possibly use this issue to execute a cross-site scripting (XSS) attack. This issue only affected Ubuntu 18.04 ESM, Ubuntu 20.04 ESM and Ubuntu 22.04 ESM. (CVE-2021-46144)