Description
In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, insufficient Cascading Style Sheets (CSS) sanitization in HTML e-mail messages may lead to SSRF or Information Disclosure, e.g., if stylesheet links point to local network hosts. This issue exists because of insufficient fixes for CVE-2026-35540, CVE-2026-48843 and CVE-2026-62643.
Mitigation
Minimal update. May introduce new vulnerabilities or breaking changes.
|
 debian 12 | | =1.6.1+dfsg-1 || =1.6.10+dfsg-1 || =1.6.10+dfsg-2 || =1.6.11+dfsg-1 || =1.6.12+dfsg-1 || =1.6.13+dfsg-1 || =1.6.14+dfsg-1 || =1.6.15+dfsg-1 || =1.6.16+dfsg-1 || =1.6.17+dfsg-1 || =1.6.18+dfsg-1 || =1.6.2+dfsg-1 || =1.6.3+dfsg-1 || =1.6.3+dfsg-1~deb12u1 || =1.6.3+dfsg-2 || =1.6.4+dfsg-1 || =1.6.4+dfsg-1~deb12u1 || =1.6.5+dfsg-1 || =1.6.5+dfsg-1+deb12u10 || =1.6.5+dfsg-1+deb12u2 || =1.6.5+dfsg-1+deb12u3 || =1.6.5+dfsg-1+deb12u4 || =1.6.5+dfsg-1+deb12u5 || =1.6.5+dfsg-1+deb12u6 || =1.6.5+dfsg-1+deb12u7 || =1.6.5+dfsg-1+deb12u8 || =1.6.5+dfsg-1+deb12u9 || =1.6.5+dfsg-1~deb12u1 || =1.6.6+dfsg-1 || =1.6.6+dfsg-2 || =1.6.7+dfsg-1 || =1.6.8+dfsg-1 || =1.6.8+dfsg-2 || =1.6.9+dfsg-1 || =1.6.9+dfsg-2 | - |
debian 13 | | =1.6.11+dfsg-1 || =1.6.12+dfsg-0+deb13u1 || =1.6.12+dfsg-1 || =1.6.13+dfsg-0+deb13u1 || =1.6.13+dfsg-1 || =1.6.14+dfsg-1 || =1.6.15+dfsg-0+deb13u1 || =1.6.15+dfsg-1 || =1.6.16+dfsg-0+deb13u1 || =1.6.16+dfsg-1 || =1.6.17+dfsg-0+deb13u1 || =1.6.17+dfsg-1 || =1.6.18+dfsg-1 | - |
debian 11 | | =1.4.11+dfsg.1-4 || =1.4.12+dfsg.1-1~bpo10+1 || =1.4.12+dfsg.1-1~deb11u1 || =1.4.13+dfsg.1-1~deb11u1 || =1.4.13+dfsg.1-1~deb11u1~bpo10+1 || =1.4.14+dfsg.1-1~deb11u1 || =1.4.14+dfsg.1-1~deb11u1~bpo10+1 || =1.4.15+dfsg.1-1+deb11u10 || =1.4.15+dfsg.1-1+deb11u3 || =1.4.15+dfsg.1-1+deb11u4 || =1.4.15+dfsg.1-1+deb11u5 || =1.4.15+dfsg.1-1+deb11u6 || =1.4.15+dfsg.1-1+deb11u7 || =1.4.15+dfsg.1-1+deb11u8 || =1.4.15+dfsg.1-1+deb11u9 || =1.4.15+dfsg.1-1~deb11u1 || =1.4.15+dfsg.1-1~deb11u1~bpo10+1 || =1.4.15+dfsg.1-1~deb11u2 || =1.4.15+dfsg.1-1~deb11u2~bpo10+1 || =1.5.0+dfsg.1-1 || =1.5.0+dfsg.1-2 || =1.5.1+dfsg-1 || =1.5~beta+dfsg.1-1 || =1.5~beta+dfsg.1-2 || =1.5~beta+dfsg.1-3 || =1.5~beta+dfsg.1-4 || =1.5~rc+dfsg.1-1 || =1.5~rc+dfsg.1-2 || =1.5~rc+dfsg.1-3 || =1.6.0+dfsg-1 || =1.6.0+dfsg-1.1 || =1.6.0+dfsg-2 || =1.6.1+dfsg-1 || =1.6.10+dfsg-1 || =1.6.10+dfsg-2 || =1.6.11+dfsg-1 || =1.6.12+dfsg-1 || =1.6.13+dfsg-1 || =1.6.14+dfsg-1 || =1.6.15+dfsg-1 || =1.6.16+dfsg-1 || =1.6.17+dfsg-1 || =1.6.18+dfsg-1 || =1.6.2+dfsg-1 || =1.6.3+dfsg-1 || =1.6.3+dfsg-1~deb12u1 || =1.6.3+dfsg-2 || =1.6.4+dfsg-1 || =1.6.4+dfsg-1~deb12u1 || =1.6.5+dfsg-1 || =1.6.5+dfsg-1~deb12u1 || =1.6.6+dfsg-1 || =1.6.6+dfsg-2 || =1.6.7+dfsg-1 || =1.6.8+dfsg-1 || =1.6.8+dfsg-2 || =1.6.9+dfsg-1 || =1.6.9+dfsg-2 || =1.6~beta+dfsg-1 || =1.6~beta+dfsg-2 || =1.6~rc+dfsg-1 || =1.6~rc+dfsg-2 | - |
debian 14 | | =1.6.11+dfsg-1 || =1.6.12+dfsg-1 || =1.6.13+dfsg-1 || =1.6.14+dfsg-1 || =1.6.15+dfsg-1 || =1.6.16+dfsg-1 || =1.6.17+dfsg-1 || >=0 <1.6.18+dfsg-1 | 1.6.18+dfsg-1 |
