FEDORA-2026-c3351f4ae4 — security update for roundcubemail

stable

roundcubemail-1.6.17-1.fc43

FEDORA-2026-c3351f4ae4 created by remi a month ago for Fedora 43

Release 1.6.17

Enigma: Support automatic public key lookup (import) using HKP v1 protocol (#5314)
Enigma: Kolab WOAT Support (#8626)
Security: Fix an infinite loop in TNEF (winmail.dat) decoder (#10193)
Security: Fix various vulnerabilities in the password plugin using session-injected username
Security: Fix stored XSS via unescaped attachment MIME type on the attachment-validation warning page [CVE-2026-54432]
Security: Fix SSRF bypass via specific local address URLs - two new cases
Security: Fix zero-click stored XSS in plain-text rendering [CVE-2026-54433]
Security: Fix DoS via crafted compressed-RTF size in the TNEF (winmail.dat) file

How to install

Updates may require up to 24 hours to propagate to mirrors. If the following command doesn't work, please retry later:

sudo dnf upgrade --refresh --advisory=FEDORA-2026-c3351f4ae4

This update has been submitted for testing by remi.

a month ago

This update's test gating status has been changed to 'ignored'.

a month ago

This update has been pushed to testing.

a month ago

This update has been submitted for stable by bodhi.

4 weeks ago

remi edited this update.

4 weeks ago

This update has been pushed to stable.

4 weeks ago

Please log in to add feedback.

Metadata

Type

security

Severity

medium

Karma

Signed

Content Type

RPM

Test Gating

ignored

Autopush Settings

Unstable by Karma

-3

Stable by Karma

Stable by Time

7 days

Dates

submitted

a month ago

in testing

a month ago

in stable

4 weeks ago

modified

4 weeks ago

approved

4 weeks ago

Builds

roundcubemail-1.6.17-1.fc43

BZ#2500063 CVE-2026-54433 roundcubemail: Roundcube Webmail: Arbitrary code execution via zero-click cross-site scripting [fedora-all]

BZ#2500065 CVE-2026-62642 roundcubemail: Roundcube Webmail: Denial of Service via infinite loop in TNEF decoder [fedora-all]

BZ#2500067 CVE-2026-62644 roundcubemail: Roundcube Webmail: Account takeover via username spoofing in password plugin [fedora-all]

BZ#2500068 CVE-2026-54432 roundcubemail: Roundcube Webmail: Stored Cross-Site Scripting via unescaped attachment MIME type [fedora-all]

BZ#2500071 CVE-2026-62641 roundcubemail: Roundcube Webmail: Denial of Service via crafted TNEF compressed-RTF size [fedora-all]

BZ#2500072 CVE-2026-62643 roundcubemail: Roundcube Webmail: Server-Side Request Forgery via insufficient CSS sanitization [fedora-all]

roundcubemail-1.6.17-1.fc43

Automated Test Results

ignored