[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <ado-k2ivxft6BukD@donburi.himad.notcom.org>
Date: Sat, 11 Apr 2026 15:37:55 +0300
From: Valtteri Vuorikoski <vuori@...com.org>
To: oss-security@...ts.openwall.com
Subject: CVE-2026-35537+more: Roundcube arbitrary write + ID/XSS/etc. prior
to 1.6.14
Roundcube, a webmail frontend, released versions 1.5.14 and 1.6.14 on March 18
with fixes to a multitude of vulnerabilities. The 1.7 pre-releases are also
affected.
>From the release announcement <https://roundcube.net/news/2026/03/18/security-updates-1.7-rc5-1.6.14-1.5.14>:
* Fix pre-auth arbitrary file write via unsafe deserialization in
redis/memcache session handler, reported by y0us.
* Fix bug where a password could get changed without providing the old
password, reported by flydragon777.
* Fix IMAP Injection + CSRF bypass in mail search, reported by Martila
Security Research Team.
* Fix remote image blocking bypass via various SVG animate attributes,
reported by nullcathedral.
* Fix remote image blocking bypass via a crafted body background attribute,
reported by nullcathedral.
* Fix fixed position mitigation bypass via use of !important, reported by
nullcathedral.
* Fix XSS issue in a HTML attachment preview, reported by aikido_security.
* Fix SSRF + Information Disclosure via stylesheet links to a local network
hosts, reported by Georgios Tsimpidas (aka Frey), Security Researcher at
https://i0.rs/.
The file write is apparently CVE-2026-35537. Roundcube still does not provide
CVE numbers in their official announcements, interested parties can look them
up for the rest for example at the Debian security tracker
<https://security-tracker.debian.org/tracker/source-package/roundcube>.
-Valtteri
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
