CVE-2020-35730

An XSS issue was discovered in Roundcube Webmail before 1.2.13, 1.3.x before 1.3.16, and 1.4.x before 1.4.10. The attacker can send a plain text e-mail message, with JavaScript in a link reference element that is mishandled by linkref_addindex in rcube_string_replacer.php.

An XSS issue was discovered in Roundcube Webmail before 1.2.13, 1.3.x before 1.3.16, and 1.4.x before 1.4.10. The attacker can send a plain text e-mail message, with JavaScript in a link reference element that is mishandled by linkref_addindex in rcube_string_replacer.php.

An XSS issue was discovered in Roundcube Webmail before 1.2.13, 1.3.x before 1.3.16, and 1.4.x before 1.4.10. The attacker can send a plain text e-mail message, with JavaScript in a link reference element that is mishandled by linkref_addindex in rcube_string_replacer.php.

Fixes stored cross-site scripting (XSS) vulnerability via HTML or plain text messages with malicious content. (CVE-2020-35730).

This update for roundcubemail fixes the following issues:

Upgrade to version 1.3.16

This is a security update to the LTS version 1.3.

It fixes a recently reported stored cross-site scripting (XSS) vulnerability via HTML or plain text messages with malicious content.

References:

• CVE-2020-18670: Cross Site Scripting (XSS) vulneraibility via database host and user in /installer/test.php (boo#1187707)
• CVE-2020-18671: Cross Site Scripting (XSS) vulnerability via smtp config in /installer/test.php (boo#1187706)
• CVE-2020-35730: cross-site scripting (XSS) vulnerability via HTML or plain text messages with malicious content (boo#1180399)

This update for roundcubemail fixes the following issues:

Upgrade to version 1.3.16

This is a security update to the LTS version 1.3.

It fixes a recently reported stored cross-site scripting (XSS) vulnerability via HTML or plain text messages with malicious content.

References:

• CVE-2020-18670: Cross Site Scripting (XSS) vulneraibility via database host and user in /installer/test.php (boo#1187707)
• CVE-2020-18671: Cross Site Scripting (XSS) vulnerability via smtp config in /installer/test.php (boo#1187706)
• CVE-2020-35730: cross-site scripting (XSS) vulnerability via HTML or plain text messages with malicious content (boo#1180399)

This update for roundcubemail fixes the following issues:

Upgrade to version 1.3.16

This is a security update to the LTS version 1.3.

It fixes a recently reported stored cross-site scripting (XSS) vulnerability via HTML or plain text messages with malicious content.

References:

• CVE-2020-18670: Cross Site Scripting (XSS) vulneraibility via database host and user in /installer/test.php (boo#1187707)
• CVE-2020-18671: Cross Site Scripting (XSS) vulnerability via smtp config in /installer/test.php (boo#1187706)
• CVE-2020-35730: cross-site scripting (XSS) vulnerability via HTML or plain text messages with malicious content (boo#1180399)

This update for roundcubemail fixes the following issues:

Upgrade to version 1.3.16

This is a security update to the LTS version 1.3.

It fixes a recently reported stored cross-site scripting (XSS) vulnerability via HTML or plain text messages with malicious content.

References:

• CVE-2020-18670: Cross Site Scripting (XSS) vulneraibility via database host and user in /installer/test.php (boo#1187707)
• CVE-2020-18671: Cross Site Scripting (XSS) vulnerability via smtp config in /installer/test.php (boo#1187706)
• CVE-2020-35730: cross-site scripting (XSS) vulnerability via HTML or plain text messages with malicious content (boo#1180399)

This update was imported from the openSUSE:Leap:15.2:Update update project.

This update for roundcubemail fixes the following issues:

Upgrade to version 1.3.16

This is a security update to the LTS version 1.3.

It fixes a recently reported stored cross-site scripting (XSS) vulnerability via HTML or plain text messages with malicious content.

References:

• CVE-2020-18670: Cross Site Scripting (XSS) vulneraibility via database host and user in /installer/test.php (boo#1187707)
• CVE-2020-18671: Cross Site Scripting (XSS) vulnerability via smtp config in /installer/test.php (boo#1187706)
• CVE-2020-35730: cross-site scripting (XSS) vulnerability via HTML or plain text messages with malicious content (boo#1180399)

This update was imported from the openSUSE:Leap:15.2:Update update project.

This update for roundcubemail fixes the following issues:

Upgrade to version 1.3.16

This is a security update to the LTS version 1.3.

It fixes a recently reported stored cross-site scripting (XSS) vulnerability via HTML or plain text messages with malicious content.

References:

• CVE-2020-18670: Cross Site Scripting (XSS) vulneraibility via database host and user in /installer/test.php (boo#1187707)
• CVE-2020-18671: Cross Site Scripting (XSS) vulnerability via smtp config in /installer/test.php (boo#1187706)
• CVE-2020-35730: cross-site scripting (XSS) vulnerability via HTML or plain text messages with malicious content (boo#1180399)

This update was imported from the openSUSE:Leap:15.2:Update update project.

This update for roundcubemail fixes the following issues:

roundcubemail was updated to 1.5.3

• Enigma: Fix initial synchronization of private keys
• Enigma: Fix double quoted-printable encoding of pgp-signed messages with no attachments (#8413)
• Fix various PHP8 warnings (#8392)
• Fix mail headers injection via the subject field on mail compose (#8404)
• Fix bug where small message/rfc822 parts could not be decoded (#8408)
• Fix setting HTML mode on reply/forward of a signed message (#8405)
• Fix handling of RFC2231-encoded attachment names inside of a message/rfc822 part (#8418)
• Fix bug where some mail parts (images) could have not be listed as attachments (#8425)
• Fix bug where attachment icons were stuck at the top of the messages list in Safari (#8433)
• Fix handling of message/rfc822 parts that are small and are multipart structures with a single part (#8458)
• Fix bug where session could time out if DB and PHP timezone were different (#8303)
• Fix bug where DSN flag state wasn't stored with a draft (#8371)
• Fix broken encoding of HTML content encapsulated in a RTF attachment (#8444)
• Fix problem with aria-hidden=true on toolbar menus in the Elastic skin (#8517)
• Fix bug where title tag content was displayed in the body if it contained HTML tags (#8540)
• Fix support for DSN specification without host e.g. pgsql:///dbname (#8558)

update to 1.5.2

• OAuth: pass 'id_token' to 'oauth_login' plugin hook (#8214)
• OAuth: fix expiration of short-lived oauth tokens (#8147)
• OAuth: fix relative path to assets if /index.php/foo/bar url is used (#8144)
• OAuth: no auto-redirect on imap login failures (#8370)
• OAuth: refresh access token in 'refresh' plugin hook (#8224)
• Fix so folder search parameters are honored by subscriptions_option plugin (#8312)
• Fix password change with Directadmin driver (#8322, #8329)
• Fix so css files in plugins/jqueryui/themes will be minified too (#8337)
• Fix handling of unicode/special characters in custom From input (#8357)
• Fix some PHP8 compatibility issues (#8363)
• Fix chpass-wrapper.py helper compatibility with Python 3 (#8324)
• Fix scrolling and missing Close button in the Select image dialog in Elastic/mobile (#8367)
• Security: fix cross-site scripting (XSS) via HTML messages with malicious CSS content

• added Suggests: php-sqlite

• use the virtual provides from each PHP module, to allow the installation of roundcubemail with various PHP versions. The only problem, we are currently facing is the automatic enablement of the PHP apache module during post-installation: Trying to evaluate the correct PHP module now during post as well, which should eleminate the pre-definition of the required PHP-Version during build completely. See https://build.opensuse.org/request/show/940859 for the initial discussion.

update to 1.5.1

• Fix importing contacts with no email address (#8227)
• Fix so session's search scope is not used if search is not active (#8199)
• Fix some PHP8 warnings (#8239)
• Fix so dark mode state is retained after closing the browser (#8237)
• Fix bug where new messages were not added to the list on refresh if skip_deleted=true (#8234)
• Fix colors on 'Show source' page in dark mode (#8246)
• Fix handling of dark_mode_support:false setting in skins meta.json - also when devel_mode=false (#8249)
• Fix database initialization if db_prefix is a schema prefix (#8221)
• Fix undefined constant error in Installer on Windows (#8258)
• Fix installation/upgrade on MySQL 5.5 - Index column size too large (#8231)
• Fix regression in setting of contact listing name (#8260)
• Fix bug in Larry skin where headers toggle state was reset on full page preview (#8203)
• Fix bug where \u200b characters were added into the recipient input preventing mail delivery (#8269)
• Fix charset conversion errors on PHP < 8 for charsets not supported by mbstring (#8252)
• Fix bug where adding a contact to trusted senders via 'Always allow from...' button didn't work (#8264,…

These are all security issues fixed in the roundcubemail-1.4.11-1.3 package on the GA media of openSUSE Tumbleweed.

It was discovered that Roundcube Webmail allowed JavaScript code to be present in the CDATA of an HTML message. A remote attacker could possibly use this issue to execute a cross-site scripting (XSS) attack. This issue only affected Ubuntu 16.04 ESM, Ubuntu 18.04 ESM and Ubuntu 20.04 ESM. (CVE-2020-12625)

It was discovered that Roundcube Webmail incorrectly processed login and logout POST requests. An attacker could possibly use this issue to launch a cross-site request forgery (CSRF) attack and force an authenticated user to be logged out. This issue only affected Ubuntu 16.04 ESM, Ubuntu 18.04 ESM and Ubuntu 20.04 ESM. (CVE-2020-12626)

It was discovered that Roundcube Webmail incorrectly processed new plugin names in rcube_plugin_api.php. An attacker could possibly use this issue to obtain sensitive information from local files or to execute arbitrary code. This issue only affected Ubuntu 16.04 ESM, Ubuntu 18.04 ESM and Ubuntu 20.04 ESM. (CVE-2020-12640)

It was discovered that Roundcube Webmail did not sanitize shell metacharacters recovered from variables in its configuration settings. An attacker could possibly use this issue to execute arbitrary code in the server. This issue only affected Ubuntu 16.04 ESM, Ubuntu 18.04 ESM and Ubuntu 20.04 ESM. (CVE-2020-12641)

It was discovered that Roundcube Webmail incorrectly sanitized characters in the username template object. An attacker could possibly use this issue to execute a cross-site scripting (XSS) attack. This issue only affected Ubuntu 16.04 ESM, Ubuntu 18.04 ESM and Ubuntu 20.04 ESM. (CVE-2020-13964)

It was discovered that Roundcube Webmail allowed preview of text/html content. A remote attacker could possibly use this issue to send a malicious XML attachment via an email message and execute a cross-site scripting (XSS) attack. This issue only affected Ubuntu 16.04 ESM, Ubuntu 18.04 ESM and Ubuntu 20.04 ESM. (CVE-2020-13965)

Andrea Cardaci discovered that Roundcube Webmail did not properly sanitize HTML special characters when dealing with HTML messages that contained an SVG element in the XML namespace. A remote attacker could possibly use this issue to execute a cross-site scripting (XSS) attack. This issue only affected Ubuntu 18.04 ESM and Ubuntu 20.04 ESM. (CVE-2020-15562)

Lukasz Pilorz discovered that Roundcube Webmail did not properly sanitize HTML special characters when dealing with HTML messages that contained SVG documents. A remote attacker could possibly use this issue to execute a cross-site scripting (XSS) attack. This issue only affected Ubuntu 18.04 ESM and Ubuntu 20.04 ESM. (CVE-2020-16145)

Alex Birnberg discovered that Roundcube Webmail incorrectly sanitized characters in plain text e-mail messages that included link reference elements. A remote attacker could possibly use this issue to execute a cross-site scripting (XSS) attack. This issue only affected Ubuntu 16.04 ESM, Ubuntu 18.04 ESM and Ubuntu 20.04 ESM. (CVE-2020-35730)

It was discovered that Roundcube Webmail did not properly sanitize HTML special characters in warning messages that contained an attachment's filename extension. A remote attacker could possibly use this issue to execute a cross-site scripting (XSS) attack. This issue only affected Ubuntu 16.04 ESM, Ubuntu 18.04 ESM and Ubuntu 20.04 ESM. (CVE-2021-44025)

It was discovered that Roundcube Webmail incorrectly managed session variables related to search functionalities. A remote attacker could possibly use this issue to execute a SQL injection attack. This issue only affected Ubuntu 16.04 ESM, Ubuntu 18.04 ESM and Ubuntu 20.04 ESM. (CVE-2021-44026)

It was discovered that Roundcube Webmail did not properly sanitize HTML special characters when dealing with HTML messages that contained CSS content. A remote attacker could possibly use this issue to execute a cross-site scripting (XSS) attack. This issue only affected Ubuntu 18.04 ESM, Ubuntu 20.04 ESM and Ubuntu 22.04 ESM. (CVE-2021-46144)