roundcube/roundcubemail 1.7.4

Roundcube Webmail 1.7.4

on GitHub

This is a security update to the version 1.7 of Roundcube Webmail.
It provides fixes to recently reported security vulnerabilities:

• Fix CSS declaration smuggling via un-encoded ampersand emission, reported by Zach Hanley of Horizon3.ai
• Fix CSS property injection via body background attribute, reported by zenithhostingevan
• Fix email header injection via bare CR in the subject field, reported by CVE-Hunter-Leo
• Fix email header injection via C-escape \r in the recipient display name, reported by dogeshark
• Fix email header injection via identity's organization field, reported by dogeshark
• Fix zero-click stored XSS via TNEF MIME tag injection in the attachment URL, reported by nakko
• Fix XSS in the HTML editor using text/enriched part content, reported by Joshua Rogers
• Fix cross-user access in contact group membership (add/remove) in the SQL address book, reported by Joshua Rogers
• Fix is_local_url() bypass via trailing-dot FQDN in stylesheet URL, reported by nept1337
• Fix remote content blocking bypass via CSS escapes in FuncIRI attributes, reported by Wahab KHADIR
• Fix remote-content blocker bypass via SVG SMIL src animation
• Fix SSRF bypass in Roundcube CSS proxy via hexadecimal IPv6-mapped IPv4 addresses, reported by faceless0x7 and Harish Annavisamy

This version is considered stable and we recommend to update all productive installations of Roundcube with it. Please do backup your data before updating!

CHANGELOG

• Use X-Content-Type-Options:nosniff for attachment previews and downloads (#10308)
• zipdownload: Fix attachment filename sanitisation of backslash and control characters (#10325)
• Security: Fix CSS declaration smuggling via un-encoded ampersand emission
• Security: Fix CSS property injection via body background attribute
• Security: Fix email header injection via bare CR in the subject field
• Security: Fix email header injection via C-escape \r in the recipient display name
• Security: Fix email header injection via identity's organization field
• Security: Fix zero-click stored XSS via TNEF MIME tag injection in the attachment URL
• Security: Fix XSS in the HTML editor using text/enriched part content
• Security: Fix cross-user access in contact group membership (add/remove) in the SQL address book
• Security: Fix is_local_url() bypass via trailing-dot FQDN in stylesheet URL
• Security: Fix remote content blocking bypass via CSS escapes in FuncIRI attributes
• Security: Fix remote-content blocker bypass via SVG SMIL src animation
• Security: Fix SSRF bypass in Roundcube CSS proxy via hexadecimal IPv6-mapped IPv4 addresses