Description
In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, an unclosed url() in a FuncIRI attribute of an SVG image could evade the remote image blocking, which may lead to information disclosure or privilege escalation.
Mitigation
Minimal update. May introduce new vulnerabilities or breaking changes.
|
 debian 14 | | =1.6.11+dfsg-1 || =1.6.12+dfsg-1 || =1.6.13+dfsg-1 || =1.6.14+dfsg-1 || =1.6.15+dfsg-1 || =1.6.16+dfsg-1 || =1.6.17+dfsg-1 || >=0 <1.6.18+dfsg-1 | 1.6.18+dfsg-1 |
debian 11 | | =1.4.11+dfsg.1-4 || =1.4.12+dfsg.1-1~bpo10+1 || =1.4.12+dfsg.1-1~deb11u1 || =1.4.13+dfsg.1-1~deb11u1 || =1.4.13+dfsg.1-1~deb11u1~bpo10+1 || =1.4.14+dfsg.1-1~deb11u1 || =1.4.14+dfsg.1-1~deb11u1~bpo10+1 || =1.4.15+dfsg.1-1+deb11u10 || =1.4.15+dfsg.1-1+deb11u3 || =1.4.15+dfsg.1-1+deb11u4 || =1.4.15+dfsg.1-1+deb11u5 || =1.4.15+dfsg.1-1+deb11u6 || =1.4.15+dfsg.1-1+deb11u7 || =1.4.15+dfsg.1-1+deb11u8 || =1.4.15+dfsg.1-1+deb11u9 || =1.4.15+dfsg.1-1~deb11u1 || =1.4.15+dfsg.1-1~deb11u1~bpo10+1 || =1.4.15+dfsg.1-1~deb11u2 || =1.4.15+dfsg.1-1~deb11u2~bpo10+1 || =1.5.0+dfsg.1-1 || =1.5.0+dfsg.1-2 || =1.5.1+dfsg-1 || =1.5~beta+dfsg.1-1 || =1.5~beta+dfsg.1-2 || =1.5~beta+dfsg.1-3 || =1.5~beta+dfsg.1-4 || =1.5~rc+dfsg.1-1 || =1.5~rc+dfsg.1-2 || =1.5~rc+dfsg.1-3 || =1.6.0+dfsg-1 || =1.6.0+dfsg-1.1 || =1.6.0+dfsg-2 || =1.6.1+dfsg-1 || =1.6.10+dfsg-1 || =1.6.10+dfsg-2 || =1.6.11+dfsg-1 || =1.6.12+dfsg-1 || =1.6.13+dfsg-1 || =1.6.14+dfsg-1 || =1.6.15+dfsg-1 || =1.6.16+dfsg-1 || =1.6.17+dfsg-1 || =1.6.18+dfsg-1 || =1.6.2+dfsg-1 || =1.6.3+dfsg-1 || =1.6.3+dfsg-1~deb12u1 || =1.6.3+dfsg-2 || =1.6.4+dfsg-1 || =1.6.4+dfsg-1~deb12u1 || =1.6.5+dfsg-1 || =1.6.5+dfsg-1~deb12u1 || =1.6.6+dfsg-1 || =1.6.6+dfsg-2 || =1.6.7+dfsg-1 || =1.6.8+dfsg-1 || =1.6.8+dfsg-2 || =1.6.9+dfsg-1 || =1.6.9+dfsg-2 || =1.6~beta+dfsg-1 || =1.6~beta+dfsg-2 || =1.6~rc+dfsg-1 || =1.6~rc+dfsg-2 | - |
debian 12 | | =1.6.1+dfsg-1 || =1.6.10+dfsg-1 || =1.6.10+dfsg-2 || =1.6.11+dfsg-1 || =1.6.12+dfsg-1 || =1.6.13+dfsg-1 || =1.6.14+dfsg-1 || =1.6.15+dfsg-1 || =1.6.16+dfsg-1 || =1.6.17+dfsg-1 || =1.6.18+dfsg-1 || =1.6.2+dfsg-1 || =1.6.3+dfsg-1 || =1.6.3+dfsg-1~deb12u1 || =1.6.3+dfsg-2 || =1.6.4+dfsg-1 || =1.6.4+dfsg-1~deb12u1 || =1.6.5+dfsg-1 || =1.6.5+dfsg-1+deb12u10 || =1.6.5+dfsg-1+deb12u2 || =1.6.5+dfsg-1+deb12u3 || =1.6.5+dfsg-1+deb12u4 || =1.6.5+dfsg-1+deb12u5 || =1.6.5+dfsg-1+deb12u6 || =1.6.5+dfsg-1+deb12u7 || =1.6.5+dfsg-1+deb12u8 || =1.6.5+dfsg-1+deb12u9 || =1.6.5+dfsg-1~deb12u1 || =1.6.6+dfsg-1 || =1.6.6+dfsg-2 || =1.6.7+dfsg-1 || =1.6.8+dfsg-1 || =1.6.8+dfsg-2 || =1.6.9+dfsg-1 || =1.6.9+dfsg-2 | - |
debian 13 | | =1.6.11+dfsg-1 || =1.6.12+dfsg-0+deb13u1 || =1.6.12+dfsg-1 || =1.6.13+dfsg-0+deb13u1 || =1.6.13+dfsg-1 || =1.6.14+dfsg-1 || =1.6.15+dfsg-0+deb13u1 || =1.6.15+dfsg-1 || =1.6.16+dfsg-0+deb13u1 || =1.6.16+dfsg-1 || =1.6.17+dfsg-0+deb13u1 || =1.6.17+dfsg-1 || =1.6.18+dfsg-1 | - |
