Source: roundcube
Version: 1.6.18+dfsg-1
Control: found -1 1.6.18+dfsg-0+deb13u1
Control: found -1 1.6.5+dfsg-1+deb12u11
Severity: important
Tags: security upstream
X-Debbugs-Cc: Debian Security Team <team@security.debian.org>

Roundcube webmail upstream has just released 1.6.19 [0] which fixes
a new batch of security vulnerabilities:

  1. CSS declaration smuggling via un-encoded ampersand emission
https://github.com/roundcube/roundcubemail/commit/8119eb061bffd6d967ee34e7bda21e20237fc1e0
  2. CSS property injection via body `background` attribute
https://github.com/roundcube/roundcubemail/commit/030de9a4e58699a336f62868017ea5271128c52f
     Follow-up: https://github.com/roundcube/roundcubemail/commit/3092bd9fbe65b243cf419352ddd3e53e5086c6cc
     Follow-up: https://github.com/roundcube/roundcubemail/commit/2869de81c94dee300df4193276cce588f10350e1
     Follow-up: https://github.com/roundcube/roundcubemail/commit/29beae7282135a3cd59a3945bd33ee8f904d6217
  3. Email header injection via bare CR in the subject field
https://github.com/roundcube/roundcubemail/commit/73d864e06cb26000a37ad57ae439842a85b6690e
  4. Email header injection via C-escape \r in the recipient display name
https://github.com/roundcube/roundcubemail/commit/d1238ef1fb0d66a9bacf6b01926b911f70515071
  5. Email header injection via identity’s organization field
https://github.com/roundcube/roundcubemail/commit/11e5c9be0369e3b76bfee2ae095f57532bae0f1f
  6. Zero-click stored XSS via TNEF MIME tag injection in the attachment URL
https://github.com/roundcube/roundcubemail/commit/e4a0f82f4c648606de0867ee16b4a5f591ddbd69
     Follow-up: https://github.com/roundcube/roundcubemail/commit/7095e8d9de10d2f8bb90c3639c582edf8e371d5c
  7. XSS in the HTML editor using text/enriched part content
https://github.com/roundcube/roundcubemail/commit/1381bf5d7e4c595560acf0228a2e68e471cefbd8
  8. Cross-user access in contact group membership (add/remove) in the SQL
     address book
https://github.com/roundcube/roundcubemail/commit/19ba077a859b590bd886b437a6c8a3fdd8aa3952
  9. `is_local_url()` bypass via trailing-dot FQDN in stylesheet URL
https://github.com/roundcube/roundcubemail/commit/9c4099bbff33062c8ab6e09d9b71e59dde295408
  10. Remote content blocking bypass via CSS escapes in FuncIRI attributes
https://github.com/roundcube/roundcubemail/commit/9aa2b3f13c3707ac24aee9899dd4ab693ee1e471
  11. Remote-content blocker bypass via SVG SMIL src animation
https://github.com/roundcube/roundcubemail/commit/2bed9eeb5707636b8e5b915ae18d4d06b3971f31
  12. SSRF bypass in Roundcube CSS proxy via hexadecimal IPv6-mapped IPv4
      addresses
https://github.com/roundcube/roundcubemail/commit/05cc67c6bc501e2d818436dec571f9712f16ea61

AFAIK no CVE-ID have been published for these issues.  I'm currently
traveling but will request some next week unless someone beats me to it.

The Debian package (in all suites) is not affected by that one, because
my patch to avoid the mlocati/ip-lib dependency already handles these
addresses.

Hi Guilhem,

That is every updated version which contain the
Avoid-dependency-on-new-package-mlocati-ip-lib.patch patch right?

Regards,
Salvatore

Hi Salvatore,

Yup indeed, local v4 ranges are mapped to v6 via the following block
https://salsa.debian.org/roundcube-team/roundcube/-/blob/debian/1.6.19+dfsg-1/debian/patches/Avoid-dependency-on-new-package-mlocati-ip-lib.patch?ref_type=tags#L210
and then compared to using @inet_pton().

The same block is present in all supported suites (bookworm LTS, trixie,
forky/sid), and support for non quad-dotted IPs and non-decimal fields,
which is what this vulnerability is about, was added in

    1.6.16+dfsg-1 (forky/sid)
    1.6.16+dfsg-0+deb13u1 (trixie)
    1.6.5+dfsg-1+deb12u9 (bookworm)
    1.4.15+dfsg.1-1+deb11u9 (bullseye)

So these versions and the later ones are not affected by this
vulnerability.  (Confirmed by backporting upstream's unit test.)

FWIW I pointed upstream at the d/p/Avoid-dependency-on-new-package-mlocati-ip-lib.patch
to avoid Factory::parseRangeString()'s limitations (and save a dependency).  They
may or may not be interested in applying it upstream.

Hi Guilhem,

Thanks, I have updated the entry as

CVE-2026-XXXX [SSRF bypass in Roundcube CSS proxy via hexadecimal IPv6-mapped IPv4 addresses]
        - roundcube 1.6.14+dfsg-1 (bug #1146838)
        [trixie] - roundcube 1.6.15+dfsg-0+deb13u1
        [bookworm] - roundcube 1.6.5+dfsg-1+deb12u8

(bullseye should go to the ELTS tracker).

Let me know. I will try to request CVEs. If I do so I will let you now
to avoid duplicate work.

Regards,
Salvatore

We believe that the bug you reported is fixed in the latest version of
roundcube, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1146838@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Guilhem Moulin <guilhem@debian.org> (supplier of updated roundcube package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Sun, 06 Sep 2026 11:50:58 +0200
Source: roundcube
Architecture: source
Version: 1.6.19+dfsg-1
Distribution: unstable
Urgency: medium
Maintainer: Debian Roundcube Maintainers <pkg-roundcube-maintainers@alioth-lists.debian.net>
Changed-By: Guilhem Moulin <guilhem@debian.org>
Closes: 1146838
Changes:
 roundcube (1.6.19+dfsg-1) unstable; urgency=medium
 .
   * New upstream security and bugfix release (closes: #1146838).
     + Fix CSS declaration smuggling via un-encoded ampersand emission.
     + Fix CSS property injection via body `background` attribute.
     + Fix email header injection via bare CR in the subject field.
     + Fix email header injection via C-escape `\r` in the recipient display
       name.
     + Fix email header injection via identity's organization field.
     + Fix zero-click stored XSS via TNEF MIME tag injection in the attachment
       URL.
     + Fix XSS in the HTML editor using text/enriched part content.
     + Fix cross-user access in contact group membership (add/remove) in the
       SQL address book.
     + Fix `is_local_url()` bypass via trailing-dot FQDN in stylesheet URL.
     + Fix remote content blocking bypass via CSS escapes in FuncIRI
       attributes.
     + Fix remote-content blocker bypass via SVG SMIL src animation.
   * Refresh d/patches and remove those applied upstream.
   * Bump debhelper compatibility level to 14 (no changes necessary).
Checksums-Sha1:
 464ea642b1482891a047cb17bf7ad34bc0a8f65e 3845 roundcube_1.6.19+dfsg-1.dsc
 42a4a432e26557e1f256016fd70522a3e5fc7dd8 126884 roundcube_1.6.19+dfsg.orig-tinymce-langs.tar.xz
 f181c2ba04cea59621711962e3553c53e9d9882a 1928432 roundcube_1.6.19+dfsg.orig-tinymce.tar.xz
 8c7c229d2ba194dc8dfb1874efb9b1401a786ff1 2910024 roundcube_1.6.19+dfsg.orig.tar.xz
 13d4f75ad1ed1be248c372759322d1acb44129fb 160184 roundcube_1.6.19+dfsg-1.debian.tar.xz
 4589269843b69e0358f7e4d288a3af88104677a5 6646 roundcube_1.6.19+dfsg-1_source.buildinfo
Checksums-Sha256:
 74d6d446c376cc65a1dd2568b0c10a0b4c29a067de5e6d44fff3d7212027ad19 3845 roundcube_1.6.19+dfsg-1.dsc
 83b2d0ee3e4d937f86d1a8db01deed4c18c1d097a964a3134f9c0748c6eb0dfb 126884 roundcube_1.6.19+dfsg.orig-tinymce-langs.tar.xz
 d6a37e1987aa5c3b027f916f18ebbb778c38ee3e0cdf236ee88725ab07cdd6f9 1928432 roundcube_1.6.19+dfsg.orig-tinymce.tar.xz
 10e6ffaeae68f5aa3d7c41fe5e5c29ca37df500ced8a2b75a0fae66f190050f1 2910024 roundcube_1.6.19+dfsg.orig.tar.xz
 dff5dc5c08ffb9539ce790f88523aefc37e2633b29479f19bc4e2ba879bcd71c 160184 roundcube_1.6.19+dfsg-1.debian.tar.xz
 2be1fb55aa99c12b8aaaa7901caaeea0aa46a8f72419f040d48c23c180309c08 6646 roundcube_1.6.19+dfsg-1_source.buildinfo
Files:
 e8a71b2daab60f2093d8500cc2a8dd4c 3845 web optional roundcube_1.6.19+dfsg-1.dsc
 8ac2d1ce8d0f3d2979ad98f17a3a5090 126884 web optional roundcube_1.6.19+dfsg.orig-tinymce-langs.tar.xz
 92283952d3baebc2b092c1298a7f4c0e 1928432 web optional roundcube_1.6.19+dfsg.orig-tinymce.tar.xz
 5d27f90436ad392e742590cc0918a18f 2910024 web optional roundcube_1.6.19+dfsg.orig.tar.xz
 95be6ab5708eb4063762df025f170946 160184 web optional roundcube_1.6.19+dfsg-1.debian.tar.xz
 f6fe37aeb331940fd911fd7282815968 6646 web optional roundcube_1.6.19+dfsg-1_source.buildinfo
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEERpy6p3b9sfzUdbME05pJnDwhpVIFAmqdfiEACgkQ05pJnDwh
pVIXJA/+OEefeNc1YypThImPpB9OZ7JBqSTOEC9qTZz8Le+ZjzUGFcJcWbls2/NO
vjAiAq8YCJH7ntbChka6IkEyiiRho2o8e6YTsjdw2TmFKhRrv+65i9Ja9MxoiXua
33uxpdJjSq2+4MlpY+rTuZ8iND8HQk3QtpeAD+7kdyRpmO4Y97gHB/Osovg0YGls
TSgKpVvr7REpgcBWaee0tcehMGWuM4x7uKmaQTMiC5qdUgntylsbG+XBQRPXOy4o
Kt49JdfD7HSM1Us3F74+rPnsWrAlAl5gIOh2VcW2Kqc3iz4HCCJfOpnoNj52Zffg
WZzQxdtW1EP5nH4qk8k4Q94K6e7OVVjc/IdZvJQnfWp2sTD0FqdAfb+BiF5msAK9
agtYJNWfAtWSaJQ99+YByFIeYAWkJjmqKQGirzFMAm11RSotEvKLWPyHSMTCbAmw
ThzmqMG9HcaDsTNymAxeKil35oS9SRJs5pOeN0cJKTqPvyLnAaVSiOiUQhDvGbS3
SGBsmxyqdESROFqehdPqFEWQPCGDiMlazw5GCVYUhI2zjTKpyfoJcQl4cpsY+gSX
ccAImUKzrge0KByJKPVZsSl57U8xs+rzQt3sETmZnK0PSPMW24bB6MvJjSXpulOZ
BPobTNP27sxpSc0p1I0YkKO+kED73kqlZb6yE1VNSMlWbSf1e0E=
=NMMt
-----END PGP SIGNATURE-----