We just published security updates to the 1.6 and 1.5 LTS versions of Roundcube Webmail. They both contain a fix for recently reported security vulnerability.
Security fixes:
- Fix Post-Auth RCE via PHP Object Deserialization reported by firs0v.
See the full changelogs in the release notes on the Github download pages for the updated versions 1.6.11 and 1.5.10.
https://github.com/roundcube/roundcubemail/releases/tag/1.6.11 https://github.com/roundcube/roundcubemail/releases/tag/1.5.10
We strongly recommend to update all productive installations of Roundcube 1.6.x and 1.5.x with this new versions.
Have I gone blind, updated to 1.6.11 and it might have been nuked earlier we migrated up from earlier series, but there used to be a little tiny person with plus sign to quickly add a recipient to contacts, it seems to be gone, so obviously I have not set something proper in 1.6, any suggestions?
On Sun, Jun 1, 2025 at 6:26 PM Aleksander Machniak alec@alec.pl wrote:
We just published security updates to the 1.6 and 1.5 LTS versions of Roundcube Webmail. They both contain a fix for recently reported security vulnerability.
Security fixes:
- Fix Post-Auth RCE via PHP Object Deserialization reported by firs0v.
See the full changelogs in the release notes on the Github download pages for the updated versions 1.6.11 and 1.5.10.
https://github.com/roundcube/roundcubemail/releases/tag/1.6.11 https://github.com/roundcube/roundcubemail/releases/tag/1.5.10
We strongly recommend to update all productive installations of Roundcube 1.6.x and 1.5.x with this new versions.
-- Alec _______________________________________________ Users mailing list -- users@lists.roundcube.net To unsubscribe send an email to users-leave@lists.roundcube.net
Just noticed its still there in Larry, but not elastic, if that helps, bug?
On Mon, Jun 9, 2025 at 12:05 PM Nick Edwards nick.z.edwards@gmail.com wrote:
Have I gone blind, updated to 1.6.11 and it might have been nuked earlier we migrated up from earlier series, but there used to be a little tiny person with plus sign to quickly add a recipient to contacts, it seems to be gone, so obviously I have not set something proper in 1.6, any suggestions?
On Sun, Jun 1, 2025 at 6:26 PM Aleksander Machniak alec@alec.pl wrote:
We just published security updates to the 1.6 and 1.5 LTS versions of Roundcube Webmail. They both contain a fix for recently reported security vulnerability.
Security fixes:
- Fix Post-Auth RCE via PHP Object Deserialization reported by firs0v.
See the full changelogs in the release notes on the Github download pages for the updated versions 1.6.11 and 1.5.10.
https://github.com/roundcube/roundcubemail/releases/tag/1.6.11 https://github.com/roundcube/roundcubemail/releases/tag/1.5.10
We strongly recommend to update all productive installations of Roundcube 1.6.x and 1.5.x with this new versions.
-- Alec _______________________________________________ Users mailing list -- users@lists.roundcube.net To unsubscribe send an email to users-leave@lists.roundcube.net
You've been living on Hong Kong for too long, it is there, just weirdly hidden, click on the recipients email, you should get 2 options, email or add contact, not sure why they did that, but yeah...
On 09/06/2025 12:05, Nick Edwards wrote:
Have I gone blind, updated to 1.6.11 and it might have been nuked earlier we migrated up from earlier series, but there used to be a little tiny person with plus sign to quickly add a recipient to contacts, it seems to be gone, so obviously I have not set something proper in 1.6, any suggestions?
On Sun, Jun 1, 2025 at 6:26 PM Aleksander Machniak alec@alec.pl wrote:
We just published security updates to the 1.6 and 1.5 LTS versions of Roundcube Webmail. They both contain a fix for recently reported security vulnerability.
Security fixes:
- Fix Post-Auth RCE via PHP Object Deserialization reported by firs0v.
See the full changelogs in the release notes on the Github download pages for the updated versions 1.6.11 and 1.5.10.
https://github.com/roundcube/roundcubemail/releases/tag/1.6.11 https://github.com/roundcube/roundcubemail/releases/tag/1.5.10
We strongly recommend to update all productive installations of Roundcube 1.6.x and 1.5.x with this new versions.
-- Alec _______________________________________________ Users mailing list -- users@lists.roundcube.net To unsubscribe send an email to users-leave@lists.roundcube.net
Users mailing list -- users@lists.roundcube.net To unsubscribe send an email to users-leave@lists.roundcube.net
-
Aleksander Machniak -
Nick Edwards -
Noel Butler