Stay Secure with the Latest Linux Advisories

security advisoryfedoracross-site scripting

Fedora 32: 2020-d0f8f20cfc Critical: Roundcubemail XSS Fixes

**RELEASE 1.4.8** - **Security**: Fix potential XSS issue in HTML editor of the identity signature input (#7507) - Managesieve: Fix too-small input field in Elastic when using custom headers (#7498) - Fix support for an error as a string in message_before_send hook (#7475) - Elastic: Fix redundant scrollbar in plain text editor on mail reply (#7500) - Elastic: Fix deleted and replied+forwarded. --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2020-d0f8f20cfc 2020-08-20 01:10:33.168063 --------------------------------------------------------------------------------Name : roundcubemail Product : Fedora 32 Version : 1.4.8 Release : 1.fc32 URL : https://roundcube.net/ Summary : Round Cube Webmail is a browser-based multilingual IMAP client Description : RoundCube Webmail is a browser-based multilingual IMAP client with an application-like user interface. It provides full functionality you expect from an e-mail client, including MIME support, address book, folder manipulation, message searching and spell checking. RoundCube Webmail is written in PHP and requires a database: MySQL, PostgreSQL and SQLite are known to work. The user interface is fully skinnable using XHTML and CSS 2. --------------------------------------------------------------------------------Update Information: **RELEASE 1.4.8** - **Security**: Fix potential XSS issue in HTML editor of the identity signature input (#7507) - Managesieve: Fix too-small input field in Elastic when using custom headers (#7498) - Fix support for an error as a string in message_before_send hook (#7475) - Elastic: Fix redundant scrollbar in plain text editor on mail reply (#7500) - Elastic: Fix deleted and replied+forwarded icons on messages list (#7503) - Managesieve: Allow angle brackets in out-of-office message body (#7518) - Fix bug in conversion of email addresses to mailto links in plain text messages (#7526) - Fix format=flowed formattingon plain text part derived from the HTML content (#7504) - Fix incorrect rewriting of internal links in HTML content (#7512) - Fix handling links without defined protocol (#7454) - Fix paging of search results on IMAP servers with no SORT capability (#7462) - Fix detecting special folders on servers with both SPECIAL-USE and LIST-STATUS (#7525) - **Security**: Fix cross-site scripting (XSS) via HTML messages with malicious svg content [CVE-2020-16145] - **Security**: Fix cross-site scripting (XSS) via HTML messages with malicious math content --------------------------------------------------------------------------------ChangeLog: * Tue Aug 11 2020 Remi Collet - 1.4.8-1 - update to 1.4.8 --------------------------------------------------------------------------------References: [ 1 ] Bug #1868344 - CVE-2020-16145 roundcubemail: xss via HTML messages with malicious svg content https://bugzilla.redhat.com/show_bug.cgi?id=1868344 --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2020-d0f8f20cfc' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ --------------------------------------------------------------------------------_______________________________________________ package-announce mailing list -- This email address is being protected from spambots. You need JavaScript enabled to view it. To unsubscribe send an email to This email address is being protected from spambots. You need JavaScript enabled to view it. Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/This email address is being protected from spambots. You need JavaScript enabled to view it./ . Roundcubemailversion 1.4.8 addresses vulnerabilities regarding XSS and enhances functionalities for better security and interface experience in Fedora.. Roundcube Mail, Fedora 32, XSS Issues, Webmail Client, Email Security. . Severity: Critical. LinuxSecurity.com Team

Aug 19, 2020 •Critical Fedora