mail/roundcube-classic: update for roundcube 1.7 PR: 295278 Submitted by: brnrdc27b9de1d9
Port details
mail/roundcube-classic1.6.0.4
Larry skin/theme for Rouncube webmail
- Maintainer
- brnrd@FreeBSD.org
- Packages
- roundcube-classic-php82 1.6.0.4, roundcube-classic-php83 1.6.0.4, roundcube-classic-php84 1.6.0.4, roundcube-classic-php85 1.6.0.4, roundcube-classic-php86 1.6.0.4
- Upstream
- up to date
- CPE
roundcube:webmailfrom the port- WWW
- https://github.com/roundcube/classic/
- Links
- cgit · VuXML
Unaddressed (34) · The CVE record lists this version as affected, no VuXML entry names the CVE
Updating to 1.6.18 would fix 33 of 34 unaddressed CVEs, according to the CVE records.
Fixed up to each version, cumulative: 1.6.7 5 · 1.6.8 7 · 1.6.11 8 · 1.6.12 10 · 1.6.14 17 · 1.6.15 18 · 1.6.17 23 · 1.6.18 33
| CVE-2025-49113 | 9.9 | 2025-06-02 | Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the _from parameter in a URL is not validated in prog… |
| CVE-2024-42008 | 9.3 | 2024-08-05 | A Cross-Site Scripting vulnerability in rcmail_action_mail_get->run() in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to steal and send email… |
| CVE-2024-42009 | 9.3 | 2024-08-05 | A Cross-Site Scripting vulnerability in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to steal and send emails of a victim via a crafted e-mai… |
| CVE-2026-74997 | 8.8 | 2026-08-17 | In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the cmd_learn driver of the markasjunk plugin is subject to remote code execution via crafted placeholder repl… |
| CVE-2026-74998 | 7.2 | 2026-08-17 | In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, responses from the CSS (Cascading Style Sheets) proxy were not validated, which may result in information disc… |
| CVE-2026-54433 | 7.2 | 2026-07-14 | In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, there is Stored Cross-Site Scripting (XSS) via a crafted plain-text email message. The attacker-controlled Jav… |
| CVE-2026-62643 | 7.2 | 2026-07-14 | In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, insufficient Cascading Style Sheets (CSS) sanitization in HTML e-mail messages may lead to SSRF or Information… |
| CVE-2025-68461 | 7.2 | 2025-12-18 | Roundcube Webmail before 1.5.12 and 1.6 before 1.6.12 is prone to a Cross-Site-Scripting (XSS) vulnerability via the animate tag in an SVG document. |
| CVE-2025-68460 | 7.2 | 2025-12-18 | Roundcube Webmail before 1.5.12 and 1.6 before 1.6.12 is prone to a information disclosure vulnerability in the HTML style sanitizer. |
| CVE-2026-75002 | 7.1 | 2026-08-17 | In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, mail search and LITERAL+ byte-count desynchronization could lead to information disclosure or privilege escala… |
| CVE-2026-75010 | 6.4 | 2026-08-17 | In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the modoboa driver of the password plugin could leak a Modoboa API authentication token to a user-controlled h… |
| CVE-2026-62644 | 6.4 | 2026-07-14 | In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, the password plugin of the Roundcube Webmail was subject to username spoofing via session data, which could le… |
| CVE-2026-35539 | 6.1 | 2026-04-03 | An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. XSS exists because of insufficient HTML attachment sanitization in preview mode. A victim must pre… |
| CVE-2024-37383 | 6.1 | 2024-06-07 | Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 allows XSS via SVG animate attributes. |
| CVE-2024-37384 | 6.1 | 2024-06-07 | Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 allows XSS via list columns from user preferences. |
| CVE-2023-47272 | 6.1 | 2023-11-06 | Roundcube 1.5.x before 1.5.6 and 1.6.x before 1.6.5 allows XSS via a Content-Type or Content-Disposition header (used for attachment preview or download). |
| CVE-2023-5631 | 6.1 | 2023-10-18 | Roundcube before 1.4.15, 1.5.x before 1.5.5, and 1.6.x before 1.6.4 allows stored XSS via an HTML e-mail message with a crafted SVG document because of program/lib/Round… |
| CVE-2023-43770 | 6.1 | 2023-09-22 | Roundcube before 1.4.14, 1.5.x before 1.5.4, and 1.6.x before 1.6.3 allows XSS via text/plain e-mail messages with crafted links because of program/lib/Roundcube/rcube_s… |
| CVE-2026-75006 | 5.8 | 2026-08-17 | In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, insufficient Cascading Style Sheets (CSS) sanitization in HTML e-mail messages may lead to SSRF or Information… |
| CVE-2026-75000 | 5.8 | 2026-08-17 | In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, improper HTML/CSS sanitization of the SVG animate "by" attribute may lead to remote image blocking bypass, whi… |
| CVE-2026-75003 | 5.8 | 2026-08-17 | In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, an unclosed url() in a FuncIRI attribute of an SVG image could evade the remote image blocking, which may lead… |
| CVE-2026-75007 | 5.4 | 2026-08-17 | In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the LDAP search filter was subject to injection via unescaped %u/%fu/%d substitution, which may lead to inform… |
| CVE-2026-74999 | 5.4 | 2026-08-17 | In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the "Add to address book" action was subject to stored XSS. |
| CVE-2026-35540 | 5.4 | 2026-04-03 | An issue was discovered in Roundcube Webmail 1.6.0 before 1.6.14. Insufficient Cascading Style Sheets (CSS) sanitization in HTML e-mail messages may lead to SSRF or Info… |
| CVE-2026-35545 | 5.3 | 2026-04-03 | An issue was discovered in Roundcube Webmail before 1.5.15 and 1.6.15. The remote image blocking feature can be bypassed via SVG content in an e-mail message. This may l… |
Show all 34
| CVE-2026-35543 | 5.3 | 2026-04-03 | An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. The remote image blocking feature can be bypassed via SVG content (with animate attributes) in an … |
| CVE-2026-35542 | 5.3 | 2026-04-03 | An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. The remote image blocking feature can be bypassed via a crafted background attribute of a BODY ele… |
| CVE-2026-35544 | 5.3 | 2026-04-03 | An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. Insufficient Cascading Style Sheets (CSS) sanitization in HTML e-mail messages may lead to a fixed… |
| CVE-2026-75004 | 4.3 | 2026-08-17 | In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, improper rule name quoting could lead to managesieve_disabled_actions setting bypass via a crafted rule name i… |
| CVE-2026-62641 | 4.3 | 2026-07-14 | In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, the TNEF decoder was subject to denial of service via a crafted compressed-RTF size. |
| CVE-2026-62642 | 4.3 | 2026-07-14 | In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, an infinite loop was discovered in the TNEF decoder, which may lead to denial of service upon opening an email… |
| CVE-2026-35541 | 4.2 | 2026-04-03 | An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. Incorrect password comparison in the password plugin could lead to type confusion that allows a pa… |
| CVE-2026-35537 | 3.7 | 2026-04-03 | An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. Unsafe deserialization in the redis/memcache session handler may lead to arbitrary file write oper… |
| CVE-2026-35538 | 3.1 | 2026-04-03 | An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. Unsanitized IMAP SEARCH command arguments could lead to IMAP injection or CSRF bypass during mail … |
VuXML only (0) · listed, port not fixed yet
None.
pkg audit reports nothing for this version.Fixed (0)
No VuXML entries for this package.
Commits (6)
mail/roundcube-classic: Chase update for PHP 8.3f76ee4c1a5
mail/roundcube-larry: Remove IGNORE_WITH_PHP 82 * same for roundcube-classicb335436066
*/*: Mark IGNORE_WITH_PHP for 8.3.X Approved by: portmgr (blanket) Sponsored by: Bounce Experts4ca6b84706
mail/roundcube-classic: move URL from pkg-descr to Makefile Approved by: portmgr (implicit)a06acc9420
mail/roundcube-classic: Add classic skin as separate port PR: 2656532eefd7958e