InfoSecBulletin Cybersecurity for mankind
Roundcube Webmail has given security updates for its 1.6 LTS and 1.7 branches. These updates fix 12 problems that could let users and servers face cross-site scripting, email header issues, data access from other users, remote content tricks, and attacks that misuse server requests.
The new versions, Roundcube 1.6.19 and 1.7.4, fix problems in how the open-source email platform handles email content, HTML, styles, attachment details, contact groups, and remote links. Admins using Roundcube 1.6.x or 1.7.x are advised to update soon.
USA Bimbo Bakeries Confirms Data Stolen in Oracle EBS Zero-Day Attack
ALERT
Roundcube Webmail fixes 12 security flaws, including zero-click XSS and SSRF bypass
New HOOKEDGE Backdoor Deployed by Hackers in European Espionage
Hackers Exploiting MikroTik RouterOS Flaw Gaining Network Access
CrowdStrike launches SafeMind, the first agentic cybersecurity solution for defenders
Claude, DeepSeek, and Qwen AI agents combinedly used to hit gov.t across Asia
India: C-DOT Launches 14 Local Quantum-Safe Technologies
14,000 Dahua cameras compromised: TP-Link flaws enable RCE
Microsoft Reveals Project Zenith Windows PCs Able to Run 30B+ AI Models Locally
Google issues warning of new Chrome zero-day flaw exploited
One important flaw that was fixed is a zero-click stored cross-site scripting flaw. This involves adding TNEF MIME tags to attachment URLs. TNEF, which stands for Transport Neutral Encapsulation Format, is often linked to Microsoft Outlook attachments. An attacker might send a special email. This email could run harmful scripts when the victim opens the message, without needing the user to click a link or open an attachment.
The updates also solve another XSS flaw in Roundcube’s HTML editor for text/enriched emails. Cross-site scripting issues can let attackers run JavaScript in a victim’s webmail session. This can help them steal session tokens, change mailbox settings, read messages, or act as the logged-in user.
Some fixes solve flaws with email header injection. These issues involved the subject line, recipient name, and an organization’s field. Header injection vulnerabilities can be abused to manipulate email metadata or insert unexpected mail headers if malicious input is not correctly sanitized.
Roundcube fixed a flaw with user access in SQL address books. The issue allowed users to add or remove members from contact groups. It may let one user change another user’s group links in some situations. This problem can put contact privacy and address book data at risk in shared or hosted Roundcube settings.
Remote content protections got several fixes for issues like CSS smuggling, HTML body background property injecting, CSS-escape bypasses in FuncIRI attributes, and animation techniques in SVG SMIL that could get around remote content blocking.
Roundcube Webmail Patches 12 Security Flaws
The updates also fix a flaw with is_local_url() that allows some website addresses with a dot at the end to get through. Attackers could trick the system into thinking an outside resource is local and go around the rules.
A fix was made for a server-side request forgery flaw in the Roundcube CSS proxy. The issue was with hexadecimal IPv6-mapped IPv4 addresses. This could allow an attacker to skip address checks and make the server ask for private or limited network resources.
Roundcube stated that complete technical information can be found in the release notes for versions 1.6.19 and 1.7.4. The project highly advises all groups using affected Roundcube versions to update quickly.
