From bbe27d70fd66802e829bb714617a33ebef89cf90 Mon Sep 17 00:00:00 2001 From: pkgagent Date: Thu, 27 Aug 2026 10:36:08 +0800 Subject: [PATCH] Update to 1.6.18 (fixes CVE-2026-74998) --- .gitignore | 4 +- roundcubemail-1.6.11-CVE-2025-68460.patch | 26 ---------- roundcubemail-1.6.11-CVE-2025-68461.patch | 60 ----------------------- roundcubemail.spec | 12 ++--- sources | 5 +- 5 files changed, 10 insertions(+), 97 deletions(-) delete mode 100644 roundcubemail-1.6.11-CVE-2025-68460.patch delete mode 100644 roundcubemail-1.6.11-CVE-2025-68461.patch diff --git a/.gitignore b/.gitignore index 2434363..7c1efc7 100644 --- a/.gitignore +++ b/.gitignore @@ -1,2 +1,2 @@ -roundcubemail-1.6.11-complete.tar.gz -roundcubemail-1.6.11-complete.tar.gz.asc +roundcubemail-1.6.18-complete.tar.gz +roundcubemail-1.6.18-complete.tar.gz.asc diff --git a/roundcubemail-1.6.11-CVE-2025-68460.patch b/roundcubemail-1.6.11-CVE-2025-68460.patch deleted file mode 100644 index 22d163f..0000000 --- a/roundcubemail-1.6.11-CVE-2025-68460.patch +++ /dev/null @@ -1,26 +0,0 @@ -diff --git a/CHANGELOG.md b/CHANGELOG.md -index 88c5531..36d4d12 100644 ---- a/CHANGELOG.md -+++ b/CHANGELOG.md -@@ -17,6 +17,7 @@ - - Fix cursor position on "below the quote" reply in HTML mode (#8700) - - Fix bug where attachments with content type of `application/vnd.ms-tnef` were not parsed (#7119) - - Fix Post-Auth RCE via PHP Object Deserialization reported by firs0v -+- Fix Information Disclosure vulnerability in the HTML style sanitizer (CVE-2025-68460) - - ## Release 1.6.10 - -diff --git a/program/lib/Roundcube/rcube_utils.php b/program/lib/Roundcube/rcube_utils.php -index b67f7f1..17c4b8e 100644 ---- a/program/lib/Roundcube/rcube_utils.php -+++ b/program/lib/Roundcube/rcube_utils.php -@@ -559,6 +559,9 @@ class rcube_utils - $value .= ' url(' . $url . ')'; - } - } -+ } elseif (preg_match('/;.*/', $val)) { -+ // Invalid or evil content, ignore -+ continue; - } else { - // whitelist ? - $value .= ' ' . $val; diff --git a/roundcubemail-1.6.11-CVE-2025-68461.patch b/roundcubemail-1.6.11-CVE-2025-68461.patch deleted file mode 100644 index 07aee6b..0000000 --- a/roundcubemail-1.6.11-CVE-2025-68461.patch +++ /dev/null @@ -1,60 +0,0 @@ -diff --git a/CHANGELOG.md b/CHANGELOG.md -index 36d4d12..2a2eaf4 100644 ---- a/CHANGELOG.md -+++ b/CHANGELOG.md -@@ -18,6 +18,7 @@ - - Fix bug where attachments with content type of `application/vnd.ms-tnef` were not parsed (#7119) - - Fix Post-Auth RCE via PHP Object Deserialization reported by firs0v - - Fix Information Disclosure vulnerability in the HTML style sanitizer (CVE-2025-68460) -+- Fix Cross-Site-Scripting vulnerability via SVG's animate tag - - ## Release 1.6.10 - -diff --git a/program/lib/Roundcube/rcube_washtml.php b/program/lib/Roundcube/rcube_washtml.php -index 93ae9f7..669d836 100644 ---- a/program/lib/Roundcube/rcube_washtml.php -+++ b/program/lib/Roundcube/rcube_washtml.php -@@ -303,7 +303,8 @@ class rcube_washtml - - // in SVG to/from attribs may contain anything, including URIs - if ($key == 'to' || $key == 'from') { -- $key = strtolower($node->getAttribute('attributeName')); -+ $key = strtolower((string) $node->getAttribute('attributeName')); -+ $key = trim(preg_replace('/^.*:/', '', $key)); - if ($key && !isset($this->_html_attribs[$key])) { - $key = null; - } -@@ -512,10 +513,14 @@ class rcube_washtml - private static function attribute_value($node, $attr_name, $attr_value) - { - $attr_name = strtolower($attr_name); -+ $attr_value = strtolower($attr_value); - - foreach ($node->attributes as $name => $attr) { - if (strtolower($name) === $attr_name) { -- if (strtolower($attr_value) === strtolower(trim($attr->nodeValue))) { -+ // Read the attribute name, remove the namespace (e.g. xlink:href => href) -+ $val = strtolower(trim($attr->nodeValue)); -+ $val = trim(preg_replace('/^.*:/', '', $val)); -+ if ($attr_value === $val) { - return true; - } - } -@@ -734,6 +739,7 @@ class rcube_washtml - // space(s) between - '/(<\/nobr>)(\s+)()/i', - // PHP bug #32547 workaround: remove title tag -+ // TODO: This is an old libxml2 bug, maybe we could drop this at some point - '/]*>.*<\/title>/iU', - // remove before BOM (#1490291) - '/<\!doctype[^>]+>[^<]*/im', -@@ -741,8 +747,7 @@ class rcube_washtml - '/^(\0\0\xFE\xFF|\xFF\xFE\0\0|\xFE\xFF|\xFF\xFE|\xEF\xBB\xBF)/', - // washtml/DOMDocument cannot handle xml namespaces - '/]+>/i', -- // washtml/DOMDocument cannot handle xml namespaces -- // HTML5 parser cannot handler ]*>/i', - ]; - diff --git a/roundcubemail.spec b/roundcubemail.spec index 4c0ab57..6c11228 100644 --- a/roundcubemail.spec +++ b/roundcubemail.spec @@ -2,13 +2,13 @@ %bcond_with internet %global with_phpfpm 1 -%global upstream_version 1.6.11 +%global upstream_version 1.6.18 %global roundcubedir %{_datadir}/roundcubemail %global _logdir /var/log Name: roundcubemail Version: %{upstream_version}%{?upstream_prever:~%{upstream_prever}} -Release: 2%{?dist} +Release: 1%{?dist} Summary: Round Cube Webmail is a browser-based multilingual IMAP client License: GPL-3.0-or-later AND GPL-2.0-only AND LGPL-2.0-or-later AND CC-BY-SA-3.0 AND MIT AND BSD-2-Clause AND BSD-3-Clause AND PHP-3.01 @@ -24,8 +24,6 @@ Source4: roundcubemail-README-rpm.txt Source5: roundcubemail-bundled.php Patch0001: roundcubemail-1.6-confpath.patch -Patch0002: roundcubemail-1.6.11-CVE-2025-68460.patch -Patch0003: roundcubemail-1.6.11-CVE-2025-68461.patch BuildArch: noarch BuildRequires: gnupg2 @@ -135,8 +133,6 @@ CSS 2. %setup -q -n roundcubemail-%{upstream_version}%{?upstream_prever:-%{upstream_prever}} %patch -P1 -p1 -b .rpm -%patch -P2 -p1 -b .rpm -%patch -P3 -p1 -b .rpm : PHP bundled libraries php %{SOURCE5} vendor/composer/installed.json @@ -251,6 +247,10 @@ fi %changelog +* Thu Aug 27 2026 PkgAgent Robot - 1.6.18-1 +- [Type] security +- [DESC] Update to 1.6.18 (fixes CVE-2026-74998) + * Mon Jan 05 2026 ze-you-liu - 1.6.11-2 - [Type] security - [DESC] Fix CVE-2025-68460, CVE-2025-68461 vulnerability diff --git a/sources b/sources index b55abb6..c372e10 100644 --- a/sources +++ b/sources @@ -1,3 +1,2 @@ -SHA512 (roundcubemail-1.6.11-complete.tar.gz) = 842d6b0f9bfdb0661de798fb83ccfbf202583214cf478fb7092529785f31b9aa8d7a1fcd63c1d6b967e396e1e2a7750669e238d112875befb3f017b6034acacc -SHA512 (roundcubemail-1.6.11-complete.tar.gz.asc) = 03bd38d3b1400d6d982d4986f8eef95b243bda4b0aa5533efc8cae1419e8ec1ed9859bc5b019cd34e293a9e6e3a4e31a7805b9c788eff078e7f5e5fd8234355a - +SHA512 (roundcubemail-1.6.18-complete.tar.gz) = c2fb9916aac3078631fcee2fb9c3c2a3b882faab6a0d8238f35ce7575dafb21f623b133e9f23910bde412aa88597d876201c281972b25d4671099f2a628b7dcf +SHA512 (roundcubemail-1.6.18-complete.tar.gz.asc) = 29d2ff38684edb93d4effb69eff2b08862ad7ec850cdfc05e7c5ef66242b14d0706fdba93fdbb12238ea639ef858ca014d0def3dcd4a3b05925014839a742983 -- Gitee