Roundcube Webmail 1.4.8

This is a service and security update to the stable version 1.4 of Roundcube Webmail.
It contains fixes for recently reported security vulnerabilities as well a small number of general improvements from our issue tracker. See the full changelog below.

Security fixes

• Fix potential XSS issue in HTML editor of the identity signature input
• Fix cross-site scripting (XSS) via HTML messages with malicious svg content [CVE-2020-16145]
• Fix cross-site scripting (XSS) via HTML messages with malicious math content

Credits for the latter two findings go to Łukasz Pilorz from Pentesters.

This version is considered stable and we recommend to update all productive installations of Roundcube with it.
Please do backup your data before updating!

CHANGELOG

• Managesieve: Fix too-small input field in Elastic when using custom headers (#7498)
• Fix support for an error as a string in message_before_send hook (#7475)
• Elastic: Fix redundant scrollbar in plain text editor on mail reply (#7500)
• Elastic: Fix deleted and replied+forwarded icons on messages list (#7503)
• Managesieve: Allow angle brackets in out-of-office message body (#7518)
• Fix bug in conversion of email addresses to mailto links in plain text messages (#7526)
• Fix format=flowed formatting on plain text part derived from the HTML content (#7504)
• Fix incorrect rewriting of internal links in HTML content (#7512)
• Fix handling links without defined protocol (#7454)
• Fix paging of search results on IMAP servers with no SORT capability (#7462)
• Fix detecting special folders on servers with both SPECIAL-USE and LIST-STATUS (#7525)
• Security: Fix potential XSS issue in HTML editor of the identity signature input (#7507)
• Security: Fix cross-site scripting (XSS) via HTML messages with malicious svg content [CVE-2020-16145]
• Security: Fix cross-site scripting (XSS) via HTML messages with malicious math content

Roundcube Webmail 1.3.15

This is a security update to the LTS version 1.3.
It fixes two recently reported cross-site scripting (XSS) vulnerabilities via HTML messages with malicious svg and math contents.

Credits for these findings go to Łukasz Pilorz from Pentesters.

This version in considered stable and we strongly recommend to update all productive installations of Roundcube 1.3.x with it.
Please do backup your data before updating!

Roundcube Webmail 1.2.12

This is a security update to the LTS version 1.2.
It fixes two recently reported cross-site scripting (XSS) vulnerabilities via HTML messages with malicious svg and math contents.

Credits for these findings go to Łukasz Pilorz from Pentesters.

We strongly recommend to update all productive installations of Roundcube 1.2.x if you cannot upgrade to a more recent version.
Please do backup your data before updating!

Roundcube Webmail 1.4.7

This is a service and security update to the stable version 1.4 of Roundcube Webmail.
It contains a fix for recently reported security vulnerability as well a small number of general improvements from our issue tracker. See the full changelog below.

Security fix

Prevent cross-site scripting (XSS) via HTML messages with malicious svg/namespace (CVE-2020-15562)

Credits for this finding go to SSD Secure Disclosure.

This version is considered stable and we recommend to update all productive installations of Roundcube with it. Please do backup your data before updating!

CHANGELOG

• Fix bug where subfolders of special folders could have been duplicated on folder list
• Increase maximum size of contact jobtitle and department fields to 128 characters
• Fix missing newline after the logged line when writing to stdout (#7418)
• Elastic: Fix context menu (paste) on the recipient input (#7431)
• Fix problem with forwarding inline images attached to messages with no HTML part (#7414)
• Fix problem with handling attached images with same name when using database_attachments/redundant_attachments (#7455)
• Security: Fix cross-site scripting (XSS) via HTML messages with malicious svg/namespace

Roundcube Webmail 1.3.14

This is a security update to the LTS version 1.3.
It fixes a recently reported cross-site scripting (XSS) vulnerability via HTML messages with malicious svg/namespace (CVE-2020-15562).

Credits for this finding go to SSD Secure Disclosure.

This version in considered stable and we strongly recommend to update all productive
installations of Roundcube 1.3.x with it. Please do backup your data before updating!

Roundcube Webmail 1.2.11

This is a security update to the LTS version 1.2.
It fixes a recently reported cross-site scripting (XSS) vulnerability via HTML messages with malicious svg/namespace (CVE-2020-15562).

Credits for this finding go to SSD Secure Disclosure.

We strongly recommend to update all productive installations of Roundcube 1.2.x
if you cannot upgrade to a more recent version. Please do backup your data before updating!

Roundcube Webmail 1.4.6

This is a follow-up release to the recently published version 1.4.5 of Roundcube Webmail.

It contains a single fix for the installer's test step which was broken with the last release. The update is therefore only relevant for new installations which use the installer to set up Roundcube.

CHANGELOG

• Installer: Fix regression in SMTP test section (#7417)

Roundcube Webmail 1.3.13

This is a follow-up release to the recently published version 1.3.12 of Roundcube Webmail.

It contains a single fix for the installer's test step which was broken with the last release. The update is therefore only relevant for new installations which use the installer to set up Roundcube.

CHANGELOG

• Installer: Fix regression in SMTP test section (#7417)

Roundcube Webmail 1.3.12

This is a service and security update to the LTS version 1.3 of Roundcube Webmail.
It contains four fixes for recently reported security vulnerabilities as well a
small number of general improvements backported from the latest stable version.
See the full changelog below.

Security fixes

• Fix XSS issue in template object 'username' (#7406)
• Fix cross-site scripting (XSS) via malicious XML attachment
• Fix a couple of XSS issues in Installer (#7406)
• Better fix for CVE-2020-12641

The latter two vulnerabilities again are related to public access to the Roundcube installer
and are therefore classified minor.

This version in considered stable and we recommend to update all productive installations
of Roundcube 1.3.x with it. Please do backup your data before updating!

CHANGELOG

• Security: Better fix for CVE-2020-12641
• Security: Fix XSS issue in template object 'username' (#7406)
• Security: Fix couple of XSS issues in Installer (#7406)
• Security: Fix cross-site scripting (XSS) via malicious XML attachment

Roundcube Webmail 1.4.5

This is a service and security update to the stable version 1.4 of Roundcube Webmail.
It contains fixes for recently reported security vulnerabilities as well a number
of general improvements from our issue tracker. See the full changelog below.

Security fixes

• Fix XSS issue in template object 'username' (#7406)
• Fix cross-site scripting (XSS) via malicious XML attachment
• Fix a couple of XSS issues in Installer (#7406)
• Better fix for CVE-2020-12641

The latter two vulnerabilities again are related to public access to the Roundcube installer
and are therefore classified minor.

This version is considered stable and we recommend to update all productive installations
of Roundcube with it. Please do backup your data before updating!

CHANGELOG

• Fix bug in extracting required plugins from composer.json that led to spurious error in log (#7364)
• Fix so the database setup description is compatible with MySQL 8 (#7340)
• Markasjunk: Fix regression in jsevent driver (#7361)
• Fix missing flag indication on collapsed thread in Larry and Elastic (#7366)
• Fix default keyservers (use keys.openpgp.org), add note about CORS (#7373, #7367)
• Password: Fix issue with Modoboa driver (#7372)
• Mailvelope: Use sender's address to find pubkeys to check signatures (#7348)
• Mailvelope: Fix Encrypt button hidden in Elastic (#7353)
• Fix PHP warning: count(): Parameter must be an array or an object... in ID command handler (#7392)
• Fix error when user-configured skin does not exist anymore (#7271)
• Elastic: Fix aspect ratio of a contact photo in mail preview (#7339)
• Fix bug where PDF attachments marked as inline could have not been attached on mail forward (#7382)
• Security: Fix a couple of XSS issues in Installer (#7406)
• Security: Fix XSS issue in template object 'username' (#7406)
• Security: Fix cross-site scripting (XSS) via malicious XML attachment
• Security: Better fix for CVE-2020-12641