Announce

announce@lists.roundcube.net

142 discussions

Security updates 0.8.6 and 0.7.3 for save-pref vulnerability
by Thomas Bruederli 27 Mar '13

27 Mar '13

After getting reports about a possible vulnerability of Roundcube which allows an attacker to modify its users preferences in a way that he/she can then read files from the server, we now published updated packages as well as patches that fix this security issue. Please update all your Roundcube installations with the new versions (0.9-rc2, 0.8.6, 0.7.4) or patch them with the published patches. Download the latest version from http://roundcube.net/download Patch for 0.9.x: http://ow.ly/jtQD0 Patch for 0.8.x: http://ow.ly/jtQHM Patch for 0.7.x: http://ow.ly/jtQK0 Patch for 0.6: http://ow.ly/jtQNd In order to find out whether one of your users has vulnerable preferences, you can run the following query on the Roundcube user database: SELECT * FROM users WHERE preferences LIKE '%generic_message_footer%' If this returns any results, you should at least clear the 'preferences' field of that user entry. Or better: entirely block the user because he or she most likely tried to exploit your system. And here's some background about the vulnerability: http://lists.roundcube.net/pipermail/dev/2013-March/022328.html Best regards, Thomas

1 0

Release candidate for version 0.9
by Thomas Bruederli 02 Mar '13

02 Mar '13

Hello all, We just published the feature-complete release candidate for the upcoming version 0.9. After adding some neat new features in 0.9-beta we now stabilized the code for the final release. Read http://trac.roundcube.net/wiki/Changelog for details. Download it from http://roundcube.net/download and update your testing systems. Use either the installto.sh or update.sh scripts to do the update as described in the UPGRADING instructions. These will take advantage of the new database schema upgrade mechanism we just added. That should make it easier and safer to keep the local database schema up-to-date with the new versions. And please report remaining bugs to our bug tracker. Best regards, Thomas

1 0

Release 0.9-beta ready for download
by Thomas Bruederli 07 Jan '13

07 Jan '13

Dear friends of Roundcube We're proud to announce the beta release of the next major version 0.9. With this milestone we introduce some important changes under the hood as well as some nice and long-awaited features: * First of all, the Roundcube Framework. The core classes providing the strong base of Roundcube's functionality have been extracted and decoupled into a Framework package. They can be used individually in other open source projects looking for solid functionality around IMAP, SMTP, MIME-handling and more. * Another major change is the new database abstraction. In order to add support for SQLite3 the PEAR:MDB2 dependency was dropped and Roundcube now uses the native PHP Data Objects (PDO). ATTENTION: due a small lack in the MySQL PDO driver, this version of Roundcube requires PHP 5.3 when using the MySQL database. * Finally we also added some new features: - Download all attachments as zip archive (zip module required) - Render thumbnails for image attachments (imagemagick is recommended) - Compose and mail view in new windows (configurable in user settings) - Upload attachment files and contact photos with drag & drop - Forward multiple emails as attachments - Show contact photos in mail view - CSV import for contacts And of course plenty of small improvements and bug fixes. See the complete Changelog at http://trac.roundcube.net/wiki/Changelog and download the new packages from http://roundcube.net/download. Please note that this is still a beta release and we recommend to test it on a separate environment. And don't forget to backup your data before installing. Have fun and let us know how the new Roundcube performs in your environment. Cheers, Thomas P.S. We're still looking for volunteers helping us to keep the translations of the Roundcube UI up-to-date. To make it even easier for you, we recently moved to Transifex. Visit our project at https://www.transifex.com/projects/p/roundcube-webmail/ and join our translation teams.

1 0

Moving translations from launchpad to Transifex
by Thomas Bruederli 02 Jan '13

02 Jan '13

Hello folks! First of all, happy new year and best wishes for 2013! I'd like to inform you that we now decided to switch from launchpad to Transifex to maintain the translations for Roundcube. The Transifex platform seems to be very solid and well-developed whereas launchpad had some serious issues which you also might have experienced. Transifex offers native support for our translation files as well as a very handy API and command line tools. That'll make it easier for us to seamlessly synchronize precious work from your translators back into the Roundcube source repository and finally publishing it. For this and many other reasons we now decided to make Transifex our new and official translation system. I know, this isn't very nice for those, who we made registering accounts on launchpad not so long ago and now we're asking you to register at yet another platform just to follow us. I admit, launchpad was a mistake and we'd like to correct this mistake rather soon. You can find Roundcube on Transifex.com at https://www.transifex.com/projects/p/roundcube-webmail. For quality reasons it is set to limited access which means that translators have to apply to become part of a translation team before they can actually start translating. So if you're interested in becoming a member for a certain language team, choose the language from the list and then click on "Join team" on the upper right part of the overview page. We promise to process your requests as fast as possible. Many thanks for all your support and we hope you'll help us to keep the Roundcube localizations up-to-date. Best regards, Thomas

1 0

Update 0.8.4 is out
by Thomas Bruederli 14 Nov '12

14 Nov '12

Dear Roundcube lovers, We just published new packages for Roundcube webmail. This service update mainly fixes the nasty bug which sneaked into the last 0.8.3 release. In addition to that, we also packed some more fixes into this release, one of them a recently reported XSS vulnerability. The buggy previous version makes the compose screen to randomly reload itself which may result in a loss of the unsent message. So if you already installed 0.8.3, please immediately update your installation with this new version. Download it from http://roundcube.net/download We apologize for the inconvenience with the previous release! Best, Thomas

1 0

Patch for 0.8.3, new release is coming soon
by Thomas Bruederli 14 Nov '12

14 Nov '12

Hello folks, We kind of made it a tradition in Roundcube to add some nasty bugs with every second release we publish :-) This time a pull request accidentally was merged into the release branch instead of git-master where we usually do the testing. The effect of this bug is the compose screen randomly reloading and likely loosing the contents you're writing. There's a patch you can download [1] and apply to any 0.8.3 installation. And a new release will follow later this week. We'd like to apologize for this inconvenience! Best, Thomas [1] http://sourceforge.net/projects/roundcubemail/files/roundcubemail/0.8.3/rou…

1 1

Update 0.8.3 released
by Thomas Bruederli 10 Nov '12

10 Nov '12

Dear subscribers Today we can announce another service release of the Roundcube webmail package. This update adds small bug fixes and improvements to the 0.8 stable series. It also fixes a possible, although unintended, DoS to the webserver running Roundcube. See http://trac.roundcube.net/wiki/Changelogfor details. We consider it stable and we recommend to update all existing Roundcube installation with this release. Download it from http://roundcube.net/download Have a nice weekend! Thomas

1 0

Update 0.8.2 is out
by Thomas Bruederli 15 Oct '12

15 Oct '12

Dear Roundcube lovers With some delay, I'm happy to announce another release of the Roundcube webmail package. This service update adds some bug fixes and small improvements to the 0.8 stable series. See the trac.roundcube.net/wiki/Changelog page for details. We consider it stable and we recommend to update all existing Roundcube installation with this release. Download it from http://roundcube.net/download Best regards, Thomas

1 0

Updates 0.8.1 and 0.7.3 released [UPDATED]
by Thomas Bruederli 17 Aug '12

17 Aug '12

Hello again What an embarrassing mistake not updating the version number when publishing a new release. Sigh! Please sorry for that! But now the packages are updated and the version definitely is 0.8.1. When re-downloading the files, please verify the md5 checksum is the same as stated on http://roundcube.net/download Now it's definitely time for the weekend :-) Best, Thomas ---------- Original message ---------- From: Thomas Bruederli <thomas(a)roundcube.net> Date: Fri, Aug 17, 2012 at 6:41 PM Subject: Updates 0.8.1 and 0.7.3 released Aloha! As usual when a new stable release arrives, there are a few things that didn't make it into that. Therefore we just published an update release adding bug fixes, some minor feature improvements and, most important, two fixes for a recently reported XSS vulnerability in Roundcube's HTML message handling. At the same same time, we also pushed out a small update for the 0.7 series with some of the important fixes back-ported. That's for all of you who didn't dare to switch to the new and shiny 0.8 release series. See the complete Changelog at http://trac.roundcube.net/wiki/Changelog and download the new packages from http://roundcube.net/download. All the best, Thomas

1 0

Re: [RoundCube Announce] Updates 0.8.1 and 0.7.3 released
by Thomas Bruederli 17 Aug '12

17 Aug '12

Sorry y'all, that release definitely came out too easy. It's right, we forgot to update the version number inside the package. A fixed package will follow soon. Sorry for the noise! ~Thomas Jan-Philipp Litza wrote: > Hi there, > > thanks for the update! I may be too stupid, but I am under the > impression that the version number in the current 0.8.1 release tarballs > downloadable from Sourceforge wasn't updated. > ./bin/installto.sh tells me > > Installation at target location is up-to-date! > > and ./program/include/iniset.php reads > > define('RCMAIL_VERSION', '0.8.0'); > > Greetings, > Jan-Philipp Litza > > > At 17.08.2012 18:41, Thomas Bruederli wrote: >> Aloha! >> >> As usual when a new stable release arrives, there are a few things >> that didn't make it into that. Therefore we just published an update >> release adding bug fixes, some minor feature improvements and, most >> important, two fixes for a recently reported XSS vulnerability in >> Roundcube's HTML message handling. >> >> At the same same time, we also pushed out a small update for the 0.7 >> series with some of the important fixes back-ported. That's for all of >> you who didn't dare to switch to the new and shiny 0.8 release series. >> >> See the complete Changelog at http://trac.roundcube.net/wiki/Changelog >> and download the new packages from http://roundcube.net/download. >> >> All the best, >> Thomas

1 0

← Newer
1
...
6
7
8
9
10
11
12
...
15
Older →

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

Announce