Description
In Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1, the remote image blocking feature can be bypassed via a crafted CSS var() value in an e-mail message, which may lead to information disclosure or access-control bypass.
Mitigation
Minimal update. May introduce new vulnerabilities or breaking changes.
|
 debian 11 | | =1.4.11+dfsg.1-4 || =1.4.12+dfsg.1-1~bpo10+1 || =1.4.12+dfsg.1-1~deb11u1 || =1.4.13+dfsg.1-1~deb11u1 || =1.4.13+dfsg.1-1~deb11u1~bpo10+1 || =1.4.14+dfsg.1-1~deb11u1 || =1.4.14+dfsg.1-1~deb11u1~bpo10+1 || =1.4.15+dfsg.1-1+deb11u3 || =1.4.15+dfsg.1-1+deb11u4 || =1.4.15+dfsg.1-1+deb11u5 || =1.4.15+dfsg.1-1+deb11u6 || =1.4.15+dfsg.1-1+deb11u7 || =1.4.15+dfsg.1-1+deb11u8 || =1.4.15+dfsg.1-1~deb11u1 || =1.4.15+dfsg.1-1~deb11u1~bpo10+1 || =1.4.15+dfsg.1-1~deb11u2 || =1.4.15+dfsg.1-1~deb11u2~bpo10+1 || >=0 <1.4.15+dfsg.1-1+deb11u9 | 1.4.15+dfsg.1-1+deb11u9 |
debian 12 | | =1.6.1+dfsg-1 || =1.6.2+dfsg-1 || =1.6.3+dfsg-1 || =1.6.3+dfsg-1~deb12u1 || =1.6.3+dfsg-2 || =1.6.4+dfsg-1 || =1.6.4+dfsg-1~deb12u1 || =1.6.5+dfsg-1 || =1.6.5+dfsg-1+deb12u2 || =1.6.5+dfsg-1+deb12u3 || =1.6.5+dfsg-1+deb12u4 || =1.6.5+dfsg-1+deb12u5 || =1.6.5+dfsg-1+deb12u6 || =1.6.5+dfsg-1+deb12u7 || =1.6.5+dfsg-1+deb12u8 || =1.6.5+dfsg-1~deb12u1 || >=0 <1.6.5+dfsg-1+deb12u9 | 1.6.5+dfsg-1+deb12u9 |
debian 13 | | =1.6.11+dfsg-1 || =1.6.12+dfsg-0+deb13u1 || =1.6.12+dfsg-1 || =1.6.13+dfsg-0+deb13u1 || =1.6.13+dfsg-1 || =1.6.14+dfsg-1 || =1.6.15+dfsg-0+deb13u1 || =1.6.15+dfsg-1 || >=0 <1.6.16+dfsg-0+deb13u1 | 1.6.16+dfsg-0+deb13u1 |
debian 14 | | =1.6.11+dfsg-1 || =1.6.12+dfsg-1 || =1.6.13+dfsg-1 || =1.6.14+dfsg-1 || =1.6.15+dfsg-1 || >=0 <1.6.16+dfsg-1 | 1.6.16+dfsg-1 |
