InfoSecBulletin Cybersecurity for mankind
Roundcube Webmail has given security updates for its 1.6 LTS and 1.7 branches. These updates fix 12 problems that could let users and servers face cross-site scripting, email header issues, data access from other users, remote content tricks, and attacks that misuse server requests.
The new versions, Roundcube 1.6.19 and 1.7.4, fix problems in how the open-source email platform handles email content, HTML, styles, attachment details, contact groups, and remote links. Admins using Roundcube 1.6.x or 1.7.x are advised to update soon.
Claude AI Cracks 25-Year NSA Cryptography Number Mystery in Just 30 Minutes
Bypassing firewalls, AI Agents Accessed Indian ‘ Data Without Permission: CERT-In
MITRE ATT&CK v20 Unveils 9 New Attack Techniques On AI Exploits, MFA Bypass, and CAPTCHA Evasion
Hackers Exploit Fortinet Flaws to Deploy Stealthy PEERSTITCH Malware on FortiGate Firewalls
Hacker stole Meta GitHub repos; Stole Source Code
Urgent patch! Zoom,NVIDIA and IBM Patch 41 Security flaws
Microsoft patches record braking 1411 flaws; 2 zero days
Anthropic unveils “OSS Scanner” Free AI Vulnerability Scanner for Open-Source Projects
Rise on RCE Exploits Targeting Hikvision Camera Flaw
FortiBleed Attack Compromised 80,000+ Devices, SonicWall Patches 4 SMA1000 Flaws CVSS 10
One important flaw that was fixed is a zero-click stored cross-site scripting flaw. This involves adding TNEF MIME tags to attachment URLs. TNEF, which stands for Transport Neutral Encapsulation Format, is often linked to Microsoft Outlook attachments. An attacker might send a special email. This email could run harmful scripts when the victim opens the message, without needing the user to click a link or open an attachment.
The updates also solve another XSS flaw in Roundcube’s HTML editor for text/enriched emails. Cross-site scripting issues can let attackers run JavaScript in a victim’s webmail session. This can help them steal session tokens, change mailbox settings, read messages, or act as the logged-in user.
Some fixes solve flaws with email header injection. These issues involved the subject line, recipient name, and an organization’s field. Header injection vulnerabilities can be abused to manipulate email metadata or insert unexpected mail headers if malicious input is not correctly sanitized.
Roundcube fixed a flaw with user access in SQL address books. The issue allowed users to add or remove members from contact groups. It may let one user change another user’s group links in some situations. This problem can put contact privacy and address book data at risk in shared or hosted Roundcube settings.
Remote content protections got several fixes for issues like CSS smuggling, HTML body background property injecting, CSS-escape bypasses in FuncIRI attributes, and animation techniques in SVG SMIL that could get around remote content blocking.
Roundcube Webmail Patches 12 Security Flaws
The updates also fix a flaw with is_local_url() that allows some website addresses with a dot at the end to get through. Attackers could trick the system into thinking an outside resource is local and go around the rules.
A fix was made for a server-side request forgery flaw in the Roundcube CSS proxy. The issue was with hexadecimal IPv6-mapped IPv4 addresses. This could allow an attacker to skip address checks and make the server ask for private or limited network resources.
Roundcube stated that complete technical information can be found in the release notes for versions 1.6.19 and 1.7.4. The project highly advises all groups using affected Roundcube versions to update quickly.
