Dear subscribers
We recently published service and security updates to the stable version
1.4 and the LTS version 1.3 of Roundcube Webmail.
They contain four fixes for recently reported security vulnerabilities as
well a number of general improvements from our issue tracker.
Security fixes:
- Fix XSS issue in template object username **
- Fix cross-site scripting (XSS) via malicious XML attachment *
- Fix a couple of XSS issues in Installer **
- Better fix for CVE-2020-12641
The latter two vulnerabilities again are related to public access to the
Roundcube installer and are therefore classified minor. See the full
changelogs in the release notes on the Github download pages [1] and [2].
In addition to the security releases 1.4.5 and 1.3.12 we today pushed
follow-up releases containing one single fix for the installer’s test step
which was broken with the former security update.
We strongly recommend to update all productive installations of Roundcube
with this new versions.
Download the latest packages from https://roundcube.net/download
Best,
Thomas & Alec
* Credits to the security researcher Matei “Mal” Badanoiu
** Credits to the security researcher LoRexxar@knownsec 404Team
[1] https://github.com/roundcube/roundcubemail/releases/tag/1.4.5
[2] https://github.com/roundcube/roundcubemail/releases/tag/1.3.12
