Skip to content

Roundcube Webmail 1.3.12
Compare
Choose a tag to compare
@thomascube thomascube released this 02 Jun 20:29
· 3785 commits to master since this release
1.3.12
This tag was signed with the committer’s verified signature.
thomascube Thomas B.
GPG key ID: D105DEA0B545B36C
Learn about vigilant mode.
7a792f8

This is a service and security update to the LTS version 1.3 of Roundcube Webmail.
It contains four fixes for recently reported security vulnerabilities as well a
small number of general improvements backported from the latest stable version.
See the full changelog below.

Security fixes

  • Fix XSS issue in template object 'username' (#7406)
  • Fix cross-site scripting (XSS) via malicious XML attachment
  • Fix a couple of XSS issues in Installer (#7406)
  • Better fix for CVE-2020-12641

The latter two vulnerabilities again are related to public access to the Roundcube installer
and are therefore classified minor.

This version in considered stable and we recommend to update all productive installations
of Roundcube 1.3.x with it. Please do backup your data before updating!

CHANGELOG

  • Security: Better fix for CVE-2020-12641
  • Security: Fix XSS issue in template object 'username' (#7406)
  • Security: Fix couple of XSS issues in Installer (#7406)
  • Security: Fix cross-site scripting (XSS) via malicious XML attachment
Assets 8