CVE and update status of the FreeBSD ports tree4,526 unaddressed CVEs in 616 portsAll times are CET

Port details

mail/roundcube1.7.5,1

Fully skinnable XHTML/CSS webmail written in PHP

0
unaddressed
0
VuXML only, still affected
19
fixed
Maintainer
ale@FreeBSD.org
Packages
roundcube-php82 1.7.5,1, roundcube-php83 1.7.5,1, roundcube-php84 1.7.5,1, roundcube-php85 1.7.5,1, roundcube-php86 1.7.5,1
Upstream
up to date
CPE
roundcube:webmail from the port
WWW
https://roundcube.net/
Links
cgit · VuXML

Unaddressed (0) · The CVE record lists this version as affected, no VuXML entry names the CVE

None. There is no CVE without a VuXML entry for this version.

VuXML only (0) · listed, port not fixed yet

None. pkg audit reports nothing for this version.

Fixed (19)

Show 19 fixed
VuXML entries whose affected range this version has left, plus CVEs from the last 90 days that this version is already past (fixed by update).
CVE-2026-749978.82026-08-17In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the cmd_learn driver of the markasjunk plugin is subject to remote code execution via crafted placeholder repl…
CVE-2026-749987.22026-08-17In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, responses from the CSS (Cascading Style Sheets) proxy were not validated, which may result in information disc…
CVE-2026-750027.12026-08-17In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, mail search and LITERAL+ byte-count desynchronization could lead to information disclosure or privilege escala…
CVE-2026-750106.42026-08-17In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the modoboa driver of the password plugin could leak a Modoboa API authentication token to a user-controlled h…
CVE-2026-750065.82026-08-17In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, insufficient Cascading Style Sheets (CSS) sanitization in HTML e-mail messages may lead to SSRF or Information…
CVE-2026-750005.82026-08-17In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, improper HTML/CSS sanitization of the SVG animate "by" attribute may lead to remote image blocking bypass, whi…
CVE-2026-750035.82026-08-17In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, an unclosed url() in a FuncIRI attribute of an SVG image could evade the remote image blocking, which may lead…
CVE-2026-750075.42026-08-17In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the LDAP search filter was subject to injection via unescaped %u/%fu/%d substitution, which may lead to inform…
CVE-2026-749995.42026-08-17In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the "Add to address book" action was subject to stored XSS.
CVE-2026-750044.32026-08-17In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, improper rule name quoting could lead to managesieve_disabled_actions setting bypass via a crafted rule name i…

Commits (190)

Alex Dupre (ale) · 1.7.5,1
mail/roundcube: Security update to 1.7.5

PR:		299613
Submitted by:	brnrd
Security:	69adacad-cba3-11f1-8135-8447094a420f
MFH:		2026Q4
1a66662c5b
Bernard Spil (brnrd) · 1.7.4,1
mail/roundcube: Security update to 1.7.4

PR:		298237
Approved by:	ale (maintainer)
Security:	e7726f5e-a9d0-11f1-93c7-8447094a420f
MFH:		2026Q3
6c73a7b278
Alex Dupre (ale) · 1.7.3,1
mail/roundcube: update to 1.7.3 release

PR:		297392
Submitted by:	brnrd
146ce8aebd
Alex Dupre (ale) · 1.7.2,1
mail/roundcube: update to 1.7.2 release (fix security issues)

PR:		296538
Submitted by:	filis
618c7d5a1f
Alex Dupre (ale) · 1.7.1,1
mail/roundcube: update to 1.7.1 release

PR:		293172
Submitted by:	brnrd
caabb2c246
Alex Dupre (ale) · 1.6.15,1
mail/roundcube: update to 1.6.15 release.
82f4c0bbaa
Alex Dupre (ale) · 1.6.14,1
mail/roundcube: update to 1.6.14 releas

PR:		293904
Submitted by:	filis
0aedfd567c
Alex Dupre (ale) · 1.6.13,1
mail/roundcube: update to 1.6.13 release.

PR:		293042
Submitted by:	Christos Chatzaras <chris@cretaforce.gr>
76befb6e17
Alex Dupre (ale) · 1.6.12,1
mail/roundcube: security update to 1.6.12

PR:		291652
Submitted By:	brnrd
Security:	3a59024c-d8cf-11f0-af8c-8447094a420f
MFH:		2025Q4
013488b822
Alex Dupre (ale) · 1.6.11_1,1
mail/roundcube: install the public_html directory

PR:		288657
Submitted by:	Oleg Streejak <oleg@pcbtech.ru>
b69a2e8614
Alex Dupre (ale) · 1.6.11,1
mail/roundcube: update to 1.6.11 release.

PR:		287208
Submitted by:	Christos Chatzaras <chris@cretaforce.gr>
4363c60bf8
Alex Dupre (ale) · 1.6.10,1
mail/roundcube: update to 1.6.10 release.

PR:		284924
Submitted by:	François Charlier <fcharlier@ploup.net>
65eaeac542
Alex Dupre (ale) · 1.6.9,1
mail/roundcube: update to 1.6.9 release.

PR:		253254
Submitted by:	Fabian Wenk <fabian@wenks.ch>
bd13085ebc
Alex Dupre (ale) · 1.6.8,1
mail/roundcube: update to 1.6.8 release

PR:		280649
Submitted by:	Fabian Wenk <fabian@wenks.ch>
32c1423426
Alex Dupre (ale) · 1.6.7,1
mail/roundcube: update to 1.6.7 release.
b7996285e4
Alex Dupre (ale) · 1.6.6,1
mail/roundcube: enable support for PHP 8.3

PR:		276864
Submitted by:	Cristiano Deana <cris@deana.it>
163c3a5e75
Alex Dupre (ale) · 1.6.6,1
mail/roundcube: update to 1.6.6 release.

PR:		276491
Submitted by:	brnrd
139ea0f5b3
Alex Dupre (ale) · 1.6.5,1
mail/roundcube: update to 1.6.5 release.
910836739c
Alex Dupre (ale) · 1.6.4,1
mail/roundcube: fix previous commit (add support for php 8.2, not 8.3).

Spotted by:	Yasuhiro Kimura <yasu@utahime.org>
0e8a4a0a60
Alex Dupre (ale) · 1.6.4,1
mail/roundcube: update to 1.6.4 release

Enable support for PHP 8.2.

PR:		274520
Submitted by:	Fabian Wenk <fabian@wenks.ch>
f45b7f2ad7
Alex Dupre (ale) · 1.6.3,1
mail/roundcube: update to 1.6.3 release.

PR:		273850
Submitted by:	brnrd
fe4258194f
Alex Dupre (ale) · 1.6.2,1
mail/roundcube: update to 1.6.2 release.
373aef4619
Muhammad Moinur Rahman (bofh) · 1.6.1,1
*/*: Mark IGNORE_WITH_PHP for 8.3.X

Approved by:	portmgr (blanket)
Sponsored by:	Bounce Experts
4ca6b84706
Muhammad Moinur Rahman (bofh) · 1.6.1,1
*/*: Remove merged or non-existent USE_PHP directives

- Remove USE_PHP=hash which is available in default php installation of
  all versions of php
  * security/pear-Horde_Crypt_Blowfish: Remove OPTION MHASH
- Remove USE_PHP=json which is available in default php installation of
  all versions of php
  * devel/pear-PHPTAL: Remove OPTION JSON
  * www/ilias: Remove OPTION SCORM2004
- Remove USE_PHP=mssql which is no longer available in php from php80
  and later and has been replaced with sqlsrv module which is Windows
  only
  * www/codeigniter: Remove OPTION MSSQL
  * www/moodle311: Remove OPTION MSSQL
  * www/moodle39: Remove OPTION MSSQL
  * www/moodle40: Remove OPTION MSSQL
  * www/moodle41: Remove OPTION MSSQL
- Remove USE_PHP=openssl which is available in default php installation
  of all versions of php
  * databases/phpmyadmin: Remove OPTION OPENSSL
  * databases/phpmyadmin5: Remove OPTION OPENSSL
  * security/pear-Horde_Crypt_Blowfish: Remove OPTION OPENSSL
  * www/nextcloud: Remove OPTION SSL
  * www/owncloud: Remove OPTION SSL
- Remove USE_PHP=pcre which is available in default php installation of
  all versions of php
  * sysutils/racktables: Remove OPTION PCRE
- Remove USE_PHP=postgresql which should be USE_PHP=pgsql and update
  following ports
  * www/typo3-11
  * www/typo3-12
- Remove USE_PHP=pdf which is no longer available as php module
  * databases/phpmyadmin: Remove OPTION PDF
- Remove USE_PHP=spl which is available in default php installation of
  all versions of php
- Remove USE_PHP=sqlsrv which was never imported into FreeBSD as that is
  Windows only php module
  * www/typo3-11: Remove OPTION SQLSRV
  * www/typo3-12: Remove OPTION SQLSRV
- Bump where DEFAULT OPTIONS are affected

Sponsored by:	Bounce Experts

Approved by:	portmgr(blanket)
0ac3a69555
Alex Dupre (ale) · 1.6.1,1
mail/roundcube: update to 1.6.1 release.
d2268bcb60
Bernard Spil (brnrd) · 1.6.0,1
mail/roundcube: Update to 1.6.0

PR:		265653
Approved by:	Maintainer timeout
72ed1c4dd5
Stefan Eßer (se) · 1.5.3,1
Remove WWW entries moved into port Makefiles

Commit b7f05445c00f has added WWW entries to port Makefiles based on
WWW: lines in pkg-descr files.

This commit removes the WWW: lines of moved-over URLs from these
pkg-descr files.

Approved by:		portmgr (tcberner)
fb16dfecae
Stefan Eßer (se) · 1.5.3,1
Add WWW entries to port Makefiles

It has been common practice to have one or more URLs at the end of the
ports' pkg-descr files, one per line and prefixed with "WWW:". These
URLs should point at a project website or other relevant resources.

Access to these URLs required processing of the pkg-descr files, and
they have often become stale over time. If more than one such URL was
present in a pkg-descr file, only the first one was tarnsfered into
the port INDEX, but for many ports only the last line did contain the
port specific URL to further information.

There have been several proposals to make a project URL available as
a macro in the ports' Makefiles, over time.

This commit implements such a proposal and moves one of the WWW: entries
of each pkg-descr file into the respective port's Makefile. A heuristic
attempts to identify the most relevant URL in case there is more than
one WWW: entry in some pkg-descr file. URLs that are not moved into the
Makefile are prefixed with "See also:" instead of "WWW:" in the pkg-descr
files in order to preserve them.

There are 1256 ports that had no WWW: entries in pkg-descr files. These
ports will not be touched in this commit.

The portlint port has been adjusted to expect a WWW entry in each port
Makefile, and to flag any remaining "WWW:" lines in pkg-descr files as
deprecated.

Approved by:		portmgr (tcberner)
b7f05445c0
Alex Dupre (ale) · 1.5.3,1
mail/roundcube: update to 1.5.3 release.
d52f473941
Muhammad Moinur Rahman (bofh) · 1.5.2,1
*/*: Ignore with php82
214a6c5f5a
Alex Dupre (ale) · 1.5.2,1
mail/roundcube: update to 1.5.2 release.

PR:		260838
Submitted by:	brnrd
7fb0362fe6
Alex Dupre (ale) · 1.5.1,1
mail/roundcube: update to 1.5.1 release.
faf770fffc
Alex Dupre (ale) · 1.5.0_1,1
mail/roundcube: fix package and bump PORTREVISION
afee0a0bdf
Alex Dupre (ale) · 1.5.0,1
mail/roundcube: update to 1.5.0 release and add php8 support

PR:		259347
Submitted by:	brnrd
af7ede723a
Alex Dupre (ale) · 1.4.11_1,1
mail/roundcube: fix newsyslog.d default config file.

PR:		256488
Submitted by:	Marko Cupać <marko.cupac@mimar.rs>
9bda07e17c
Mathieu Arnold (mat) · 1.4.11,1
One more small cleanup, forgotten yesterday. Reported by:	lwhsu
cf118ccf87
Mathieu Arnold (mat) · 1.4.11,1
Remove # $FreeBSD$ from Makefiles.
305f148f48
Alex Dupre (ale) · 1.4.11,1
Update to 1.4.11 release and set IGNORE with php 8.
b83f884187
Alex Dupre (ale) · 1.4.10,1
Update to 1.4.10 release and pet portlint.
b736810359
Alex Dupre (ale) · 1.4.9,1
Update to 1.4.9 release.
9a4ed470a7
Alex Dupre (ale) · 1.4.8,1
Update to 1.4.8 release.
a77f57758b
Alex Dupre (ale) · 1.4.7,1
Update to 1.4.7 release.
9c986eeeb8
Alex Dupre (ale) · 1.4.6,1
Update to 1.4.6 release.
4d9e80ab19
Alex Dupre (ale) · 1.4.5,1
Update to 1.4.5 release.
ce212c500e
Alex Dupre (ale) · 1.4.4,1
Update to 1.4.4 release.
4ed6649b26
Alex Dupre (ale) · 1.4.3,1
Update to 1.4.3 release.

PR:		244525
Submitted by:	brnrd
ac43d9879a
Alex Dupre (ale) · 1.4.2,1
Update to 1.4.2 release.
71c17b9752
Alex Dupre (ale) · 1.4.1_1,1
Add ctype dependency.

See https://github.com/roundcube/roundcubemail/issues/7049

Reported by:	Tim Bishop <tim@bishnet.net>
cc609a0c8a
Alex Dupre (ale) · 1.4.1,1
Update to 1.4.1 release and remove obsolete suhosin patches.
c24f717c54
Alex Dupre (ale) · 1.3.10,1
Really fix the NSC option.

For some unknown (at least to me) and weird reason even if spellchecker.php
was appended to RCUBECOMP it didn't go in the for loop:

@${ECHO} ${RCUBECOMP} # prints spellchecker.php
.for i in ${RCUBECOMP}
	@{ECHO} ${i} # never prints spellchecker.php
        @cd ${WRKSRC} && ${COPYTREE_SHARE} ${i} ${STAGEDIR}${WWWDIR}
.endfor
b76892bee9
page 1 of 4older →oldest »