Users

users@lists.roundcube.net

8 participants
2926 discussions

IOCs for the recently disclosed RCE
by Drew Weaver 05 Jun '25

05 Jun '25

Hello, Has anyone figured out any IOCs for the recently disclosed RCE? I'm guessing they were just going to Shodan and looking for any RC systems running <= 1.6.10 and then popping them automatically but does anyone have any things to look for to check? We're probably just going to re-do our instances from scratch anyway but I'm just wondering. Thanks, -Drew

1 0

1.7 changes wtf
by Nick Edwards 05 Jun '25

05 Jun '25

I know its not released but my jaw dropped when I read this *Updating to 1.7 or higher* *From Roundcube 1.7 you must configure your web server to use the public_html folder as the document root.* ummm, what the actual fsck? public_htrml ???????? who the hell uses public_html on webmail servers, or any hosting server for that matter, I've not seen that directory used since the 90s, please tell us that is a placeholder, or some left over from version 0.01a

6 7

Ever imagined about owning a
by g5dntegj＠nqmo.com 02 Jun '25

02 Jun '25

Ever imagined about owning a piece of land that is adjacent to your existing property? What if you've been using it openly and without interruption for years, even though the title isn't officially in your name? https://www.marsillpost.com

1 0

[RCD] Security updates 1.5.10 and 1.6.11 released
by Aleksander Machniak 01 Jun '25

01 Jun '25

We just published security updates to the 1.6 and 1.5 LTS versions of Roundcube Webmail. They both contain a fix for recently reported security vulnerability. Security fixes: - Fix Post-Auth RCE via PHP Object Deserialization reported by firs0v. See the full changelogs in the release notes on the Github download pages for the updated versions 1.6.11 and 1.5.10. https://github.com/roundcube/roundcubemail/releases/tag/1.6.11 https://github.com/roundcube/roundcubemail/releases/tag/1.5.10 We strongly recommend to update all productive installations of Roundcube 1.6.x and 1.5.x with this new versions. -- Alec

1 0

Migrating mail servers, Questions on Roundcube from 1.0.3 to 1.6.9
by Robert Moskowitz 22 May '25

22 May '25

Greetings! I have been on this list since 12/12, but really quite for the last many years. last contribution 2/19.... Anyway, I FINALLY am getting my act together and replacing all my home-grown work from 2012ish to Mail-in-a-Box. Thus Roundcube 1.6.9 I have yet to figure out how to set up the view as it is/was in 1.0.3. I can get the left pane to show the folders. Though I can't get this to be "remembered" between sessions. I have not found how to have the right pane list the messages with easy search for messages based on whatever. So guidance is greatly appreciated before I have to train my users on this version after over 10 years on 1.0.3! Thank you. I suspect there will be more questions as I work through what the upgrade will mean to my users (with my wife always responding that "upgrade" is typically a "downgrade" in services provided!).

1 0

Minimum SQL Privileges Required
by Matthew J Black 02 May '25

02 May '25

Hi All, I am enquiring as to the *minimum* privileges required by the RoundCube user to access the backend SQL (MariaDB) Server. Yes, I am aware that the Wiki says (on the Installation page) to use `GRANT ALL PRIVILEGES`, as do all of the On-Line Tutorials scattered across the Web. However, that is a *massive* security hole, especially if the backend server is *not* the same as the web server hosting RoundCube. Surely, for example, the RoundCube User does *not* need the ability to create other users or tables, drop the backend database, or grant privileges to other users. Thus, I am enquiring what *are* the *minimum* privileges required? I am going to assume - and please correct me if I am wrong - that the *required* privileges are: * DELETE, INSERT, SELECT, and UPDATE If this information is available on-line, could someone please point me in the correct direction - if not, could one of the devs and/or one of the experienced RoundCube users please let me know this information - thank you. Thanks in advance Cheers Dulux-Oz -- PEREGRINE I.T. Pty Ltd Signature ================================================== *Matthew J BLACK* M.Inf.Tech.(Data Comms) MBA B.Sc. MACS (Snr), CP, IP3P When you want it done /right/ – the first time! Phone: +61 4 0411 0089 Email: matthew(a)peregrineit.net <mailto:matthew@peregrineit.net> Web: www.peregrineit.net <http://www.peregrineit.net> View Matthew J BLACK’s profile on LinkedIn <https://au.linkedin.com/in/mjblack> This Email is intended only for the addressee. Its use is limited to that intended by the author at the time and it is not to be distributed without the author’s consent. You must not use or disclose the contents of this Email, or add the sender’s Email address to any database, list, or mailing list unless you are expressly authorised to do so. Unless otherwise stated, PEREGRINE I.T. Pty Ltd accepts no liability for the contents of this Email except where subsequently confirmed in writing. The opinions expressed in this Email are those of the author and do not necessarily represent the views of PEREGRINE I.T. Pty Ltd. This Email is confidential and may be subject to a claim of legal privilege. If you have received this Email in error, please notify the author and delete this message immediately.

3 3

Re: Minimum SQL Privileges Required
by Matthew J Black 02 May '25

02 May '25

That's a great idea (& one I was aware of - thanks) but that doesn't answer my question :-) Unless you are implying that my assumption was correct (ie DELETE, INSERT, SELECT, and UPDATE ). On 2/5/25 18:37, Reindl Harald (privat) wrote: > you can specifiy even two users to seperate read-only and writes > > $rcmail_config['db_dsnw'] = > 'mysqli://roundcube_rw:*****@127.0.0.1:3306/roundcube_db'; > $rcmail_config['db_dsnr'] = > 'mysqli://roundcube_ro:*****@127.0.0.1:3306/roundcube_db'; > > Am 02.05.25 um 10:00 schrieb Matthew J Black: >> Hi All, >> >> I am enquiring as to the *minimum* privileges required by the >> RoundCube user to access the backend SQL (MariaDB) Server. >> >> Yes, I am aware that the Wiki says (on the Installation page) to use >> `GRANT ALL PRIVILEGES`, as do all of the On-Line Tutorials scattered >> across the Web. However, that is a *massive* security hole, >> especially if the backend server is *not* the same as the web server >> hosting RoundCube. Surely, for example, the RoundCube User does *not* >> need the ability to create other users or tables, drop the backend >> database, or grant privileges to other users. >> >> Thus, I am enquiring what *are* the *minimum* privileges required? >> >> I am going to assume - and please correct me if I am wrong - that the >> *required* privileges are: >> >> * DELETE, INSERT, SELECT, and UPDATE >> >> If this information is available on-line, could someone please point >> me in the correct direction - if not, could one of the devs and/or >> one of the experienced RoundCube users please let me know this >> information - thank you. -- PEREGRINE I.T. Pty Ltd Signature ================================================== *Matthew J BLACK* M.Inf.Tech.(Data Comms) MBA B.Sc. MACS (Snr), CP, IP3P When you want it done /right/ – the first time! Phone: +61 4 0411 0089 Email: matthew(a)peregrineit.net <mailto:matthew@peregrineit.net> Web: www.peregrineit.net <http://www.peregrineit.net> View Matthew J BLACK’s profile on LinkedIn <https://au.linkedin.com/in/mjblack> This Email is intended only for the addressee. Its use is limited to that intended by the author at the time and it is not to be distributed without the author’s consent. You must not use or disclose the contents of this Email, or add the sender’s Email address to any database, list, or mailing list unless you are expressly authorised to do so. Unless otherwise stated, PEREGRINE I.T. Pty Ltd accepts no liability for the contents of this Email except where subsequently confirmed in writing. The opinions expressed in this Email are those of the author and do not necessarily represent the views of PEREGRINE I.T. Pty Ltd. This Email is confidential and may be subject to a claim of legal privilege. If you have received this Email in error, please notify the author and delete this message immediately.

1 0

Bouncing emails
by doreen.imagezone＠gmail.com 01 May '25

01 May '25

What can i do not to get bouncing emails on Gmail to the corporate email on round cube . If all SPF, DKIM & DMARC records have been corrected and validated. The server host has said i consult will the mail service provider whose round cube. How do i go about this?

3 2

Size of compose/reply pop up window
by Michael Heydekamp 30 Apr '25

30 Apr '25

Recently the default size of the compose/reply pop up window changed to an awkward size. I can manually adjust it but I can't figure out how to save it to the initial default size. I thought it was a Firefox issue at first but it appears to be isolated to this webmail. Any suggestions? Deleted cookies of the relevant domain, that didn't help. Roundube 1.6.6, Win10 Pro, FF 128.10.0esr (The text above was copied from a post in the Roundcube forum from Jan 2018, which received no response at all. See https://www.roundcubeforum.net/index.php?topic=24695.msg67347#msg67347) Cheers, -- Michael Heydekamp Co-Admin freexp.de Düsseldorf/Germany

1 0

SMTP Configuration
by White, Phil 20 Apr '25

20 Apr '25

Hi All Apologies for what must be a rather basic question -- but I've hit a brick wall in getting Roundcube working. Can anyone please help identify what is wrong? Going to the installer -- /installer/index.php?_step=3, everything appears configured correctly. Crucially, the 'Test SMTP config' and 'Test IMAP config' sections work without error. The test email sent is received at the intended destination. However, when logged in to an IMAP account, I am unable to send any email. The attempt gives the error: "SMTP Error (): Authentication failed." My SMTP server is on the same box as Roundcube. It accepts email submission via SMTP on ports 25, 465, and 587, although I could probably look at other methods (pipe, socket,...) For clients on the local network, no authentication is necessary, although I permit this if a client issues an AUTH command (because I use it for testing). For example, the following command works: swaks --server 192.168.123.254:465 --tls-on-connect --to whitepj(a)mydomain.co.uk --auth-user test_user --auth-password user_password --auth PLAIN My Roundcube configuration has been through several edits based on suggestions from the web. It is currently: $config['smtp_host'] = '192.168.123.254:25'; $config['smtp_auth_type'] = null; Roundcube version is 1.6.10 In Errors.log, I get the following: [20-Apr-2025 10:06:40 +0000]: <gln3hk80> PHP Error: SMTP server does not support authentication (POST /?_task=mail&_unlock=loading1745143624474&_framed=1&_action=send) [20-Apr-2025 10:06:40 +0000]: <gln3hk80> SMTP Error: Authentication failure: test message SIZE 8388608 8BITMIME DSN ETRN VRFY EXPN PIPELINING PIPECONNECT CHUNKING STARTTLS PRDR HELP (Code: 250) in /<...snip...>/htdocs/program/lib/Roundcube/rcube.php on line 1795 (POST /?_task=mail&_unlock=loading1745143624474&_framed=1&_action=send) Many thanks. Phil

2 3

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

Users