CVE-2023-5631

Roundcube before 1.4.15, 1.5.x before 1.5.5, and 1.6.x before 1.6.4 allows stored XSS via an HTML e-mail message with a crafted SVG document because of program/lib/Roundcube/rcube_washtml.php behavior. This could allow a remote attacker to load arbitrary JavaScript code.

Roundcube before 1.4.15, 1.5.x before 1.5.5, and 1.6.x before 1.6.4 allows stored XSS via an HTML e-mail message with a crafted SVG document because of program/lib/Roundcube/rcube_washtml.php behavior. This could allow a remote attacker to load arbitrary JavaScript code.

Roundcube before 1.4.15, 1.5.x before 1.5.5, and 1.6.x before 1.6.4 allows stored XSS via an HTML e-mail message with a crafted SVG document because of program/lib/Roundcube/rcube_washtml.php behavior. This could allow a remote attackerto load arbitrary JavaScript code.

Updated roundcubemail package fixes security vulnerabilities:

Fix cross-site scripting (XSS) vulnerability in setting Content-Type/ Content-Disposition for attachment preview/download (CVE-2023-47272)

Fix cross-site scripting (XSS) vulnerability in handling of SVG in HTML messages. (CVE-2023-5631)

Some other errors have been fixed:

• Fix PHP8 fatal error when parsing a malformed BODYSTRUCTURE
• Fix duplicated Inbox folder on IMAP servers that do not use Inbox folder with all capital letters
• Fix PHP warnings
• Fix UI issue when dealing with an invalid managesieve_default_headers value
• Fix bug where images attached to application/smil messages weren't displayed
• Fix PHP string replacement error in utils/error.php
• Fix regression where smtp_user did not allow pre/post strings before/after %u placeholder

This update for roundcubemail fixes the following issues:

Update to version 1.6.4 (boo#1216429):

• CVE-2023-5631: Fix cross-site scripting vulnerability in handling of SVG in HTML messages
• Fix PHP8 warnings
• Fix default 'mime.types' path on Windows
• Managesieve: Fix javascript error when relational or spamtest extension is not enabled

These are all security issues fixed in the roundcubemail-1.6.4-1.1 package on the GA media of openSUSE Tumbleweed.

Matthieu Faou and Denys Klymenko discovered that Roundcube incorrectly handled certain SVG images. A remote attacker could possibly use this issue to load arbitrary JavaScript code. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS and Ubuntu 23.10. (CVE-2023-5631)

Rene Rehme discovered that Roundcube incorrectly handled certain headers. A remote attacker could possibly use this issue to load arbitrary JavaScript code. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS and Ubuntu 23.10. (CVE-2023-47272)

Valentin T. and Lutz Wolf discovered that Roundcube incorrectly handled certain SVG images. A remote attacker could possibly use this issue to load arbitrary JavaScript code. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS and Ubuntu 23.10. (CVE-2024-37383)

Huy Nguyễn Phạm Nhật discovered that Roundcube incorrectly handled certain fields in user preferences. A remote attacker could possibly use this issue to load arbitrary JavaScript code. (CVE-2024-37384)