openSUSE Security Update: Security update for roundcubemail
______________________________________________________________________________

Announcement ID:    openSUSE-SU-2024:0328-1
Rating:             moderate
References:         #1228900 #1228901 
Cross-References:   CVE-2024-42008 CVE-2024-42009 CVE-2024-42010
                   
Affected Products:
                    openSUSE Backports SLE-15-SP5
                    openSUSE Backports SLE-15-SP6
______________________________________________________________________________

   An update that fixes three vulnerabilities is now available.

Description:

   This update for roundcubemail fixes the following issues:

   Update to 1.6.8 This is a security update to the stable version 1.6 of
   Roundcube Webmail. It provides fixes to recently reported security
   vulnerabilities:

     * Fix XSS vulnerability in post-processing of sanitized HTML content
       [CVE-2024-42009]
     * Fix XSS vulnerability in serving of attachments other than HTML or SVG
       [CVE-2024-42008]
     * Fix information leak (access to remote content) via insufficient CSS
       filtering [CVE-2024-42010]

     CHANGELOG

     * Managesieve: Protect special scripts in managesieve_kolab_master mode
     * Fix newmail_notifier notification focus in Chrome (#9467)
     * Fix fatal error when parsing some TNEF attachments (#9462)
     * Fix double scrollbar when composing a mail with many plain text lines
       (#7760)
     * Fix decoding mail parts with multiple base64-encoded text blocks
       (#9290)
     * Fix bug where some messages could get malformed in an import from a
       MBOX file (#9510)
     * Fix invalid line break characters in multi-line text in Sieve scripts
       (#9543)
     * Fix bug where "with attachment" filter could fail on some fts engines
       (#9514)
     * Fix bug where an unhandled exception was caused by an invalid image
       attachment (#9475)
     * Fix bug where a long subject title could not be displayed in some
       cases (#9416)
     * Fix infinite loop when parsing malformed Sieve script (#9562)
     * Fix bug where imap_conn_option's 'socket' was ignored (#9566)
     * Fix XSS vulnerability in post-processing of sanitized HTML content
       [CVE-2024-42009]
     * Fix XSS vulnerability in serving of attachments other than HTML or SVG
       [CVE-2024-42008]
     * Fix information leak (access to remote content) via insufficient CSS
       filtering [CVE-2024-42010]


Patch Instructions:

   To install this openSUSE Security Update use the SUSE recommended installation methods
   like YaST online_update or "zypper patch".

   Alternatively you can run the command listed for your product:

   - openSUSE Backports SLE-15-SP6:

      zypper in -t patch openSUSE-2024-328=1

   - openSUSE Backports SLE-15-SP5:

      zypper in -t patch openSUSE-2024-328=1



Package List:

   - openSUSE Backports SLE-15-SP6 (noarch):

      roundcubemail-1.6.8-bp156.2.3.1

   - openSUSE Backports SLE-15-SP5 (noarch):

      roundcubemail-1.6.8-bp155.2.12.1


References:

   https://www.suse.com/security/cve/CVE-2024-42008.html
   https://www.suse.com/security/cve/CVE-2024-42009.html
   https://www.suse.com/security/cve/CVE-2024-42010.html
   https://bugzilla.suse.com/1228900
   https://bugzilla.suse.com/1228901