Roundcube
The Roundcube Webmail suite
Alternative to: gmail, outlook, yahoo mail
About
Versions (100)
1.5.8
2024-08-04This is a security update to the stable version 1.5 of Roundcube Webmail. It provides fixes to recently reported security vulnerabilities:
- Fix XSS vulnerability in post-processing of sanitized HTML content [CVE-2024-42009]
- Fix XSS vulnerability in serving of attachments other than HTML or SVG [CVE-2024-42008]
- Fix information leak (access to remote content) via insufficient CSS filtering [CVE-2024-42010]
Credits to Oskar Zeino-Mahmalat (Sonar) for all these findings and thanks for providing a very detailed report in a private communication.
This version is considered stable and we recommend to update all productive installations of Roundcube 1.5.x with it. Please do backup your data before updating!