Bug 296538 - update mail/roundcube to 1.7.2 to fix security issues
Summary: update mail/roundcube to 1.7.2 to fix security issues
Status: Closed FIXED
Alias: None
Product: Ports & Packages
Classification: Unclassified
Component: Individual Port(s) (show other bugs)
Version: Latest
Hardware: Any Any
: --- Affects Many People
Assignee: Alex Dupre
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2026-07-05 15:47 UTC by filis
Modified: 2026-07-06 08:17 UTC (History)
0 users

See Also:
bugzilla: maintainer-feedback? (ale)

Attachments
patch to update port to 1.7.2 (922 bytes, patch)
2026-07-05 15:52 UTC, filis 		no flags Details | Diff
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description filis freebsd_committer freebsd_triage 2026-07-05 15:47:31 UTC 
This is a security update to the version 1.7 of Roundcube Webmail.
It provides fixes to recently reported security vulnerabilities:

    Fix an infinite loop in TNEF (winmail.dat) decoder (#10193), reported by stafra.
    Fix various vulnerabilities in the password plugin using session-injected username, reported by Glendaenri and peppersghost.
    Fix stored XSS via unescaped attachment MIME type on the attachment-validation warning page [CVE-2026-54432], reported by Bohdan Kurinnoy, Samsung R&D Instit
    Fix SSRF bypass via specific local address URLs - two new cases, reported by Leenear.
    Fix zero-click stored XSS in plain-text rendering [CVE-2026-54433], reported by Bohdan Kurinnoy, Samsung R&D Institute Ukraine (SRUKR).
    Fix DoS via crafted compressed-RTF size in the TNEF (winmail.dat) file, reported by h0rk1p.
Comment 1 filis freebsd_committer freebsd_triage 2026-07-05 15:52:00 UTC 
Created attachment 272513 [details]
patch to update port to 1.7.2

builds on 14.4 and 15.0
Comment 2 commit-hook freebsd_committer freebsd_triage 2026-07-06 08:17:39 UTC 
A commit in branch main references this bug:

URL: https://cgit.FreeBSD.org/ports/commit/?id=618c7d5a1f7670779f6382fe238b388c6c2e07fc

commit 618c7d5a1f7670779f6382fe238b388c6c2e07fc
Author:     Alex Dupre <ale@FreeBSD.org>
AuthorDate: 2026-07-06 08:15:35 +0000
Commit:     Alex Dupre <ale@FreeBSD.org>
CommitDate: 2026-07-06 08:16:49 +0000

    mail/roundcube: update to 1.7.2 release (fix security issues)

    PR:             296538
    Submitted by:   filis

 mail/roundcube/Makefile | 2 +-
 mail/roundcube/distinfo | 6 +++---
 2 files changed, 4 insertions(+), 4 deletions(-)