InfoSecBulletin Cybersecurity for mankind
Roundcube Webmail has given security updates for its 1.6 LTS and 1.7 branches. These updates fix 12 problems that could let users and servers face cross-site scripting, email header issues, data access from other users, remote content tricks, and attacks that misuse server requests.
The new versions, Roundcube 1.6.19 and 1.7.4, fix problems in how the open-source email platform handles email content, HTML, styles, attachment details, contact groups, and remote links. Admins using Roundcube 1.6.x or 1.7.x are advised to update soon.
Microsoft Patches CVSS 10.0 Azure AI Foundry Vulnerability Allowing Privilege Escalation
AWS is unable to restore access to Bahrain, one UAE cloud data zone after war damage
Cisco Warns of Critical ISE 0-Day Flaw and Hackers Allegedly Selling Fortinet FortiGate 1-Day Flaw
Anthropic prepares “Claude Money” to analyze bank account and financial data
GhostCode Phishing Kit Evades Microsoft 365 MFA to Hijack Accounts in 78 Seconds
CISA Warns of Cisco Secure Email Gateway 0-Day Flaw Actively Exploited in Attacks
VPN flaw exposed 246,000 personnel records in japan
Hackers deploy Casbaneiro Trojan that activates on bank websites
German police read Signal, Telegram, WhatsApp messages without breaking encryption
Urgent Patch! cPanel, GitLab Flaws Expose Users to RCE, File and Credential Theft
One important flaw that was fixed is a zero-click stored cross-site scripting flaw. This involves adding TNEF MIME tags to attachment URLs. TNEF, which stands for Transport Neutral Encapsulation Format, is often linked to Microsoft Outlook attachments. An attacker might send a special email. This email could run harmful scripts when the victim opens the message, without needing the user to click a link or open an attachment.
The updates also solve another XSS flaw in Roundcube’s HTML editor for text/enriched emails. Cross-site scripting issues can let attackers run JavaScript in a victim’s webmail session. This can help them steal session tokens, change mailbox settings, read messages, or act as the logged-in user.
Some fixes solve flaws with email header injection. These issues involved the subject line, recipient name, and an organization’s field. Header injection vulnerabilities can be abused to manipulate email metadata or insert unexpected mail headers if malicious input is not correctly sanitized.
Roundcube fixed a flaw with user access in SQL address books. The issue allowed users to add or remove members from contact groups. It may let one user change another user’s group links in some situations. This problem can put contact privacy and address book data at risk in shared or hosted Roundcube settings.
Remote content protections got several fixes for issues like CSS smuggling, HTML body background property injecting, CSS-escape bypasses in FuncIRI attributes, and animation techniques in SVG SMIL that could get around remote content blocking.
Roundcube Webmail Patches 12 Security Flaws
The updates also fix a flaw with is_local_url() that allows some website addresses with a dot at the end to get through. Attackers could trick the system into thinking an outside resource is local and go around the rules.
A fix was made for a server-side request forgery flaw in the Roundcube CSS proxy. The issue was with hexadecimal IPv6-mapped IPv4 addresses. This could allow an attacker to skip address checks and make the server ask for private or limited network resources.
Roundcube stated that complete technical information can be found in the release notes for versions 1.6.19 and 1.7.4. The project highly advises all groups using affected Roundcube versions to update quickly.
