New release fixes security volunerabities:

- Fix Cross-Site-Scripting vulnerability via SVG's animate tag reported by Valentin T., CrowdStrike.
- Fix Information Disclosure vulnerability in the HTML style sanitizer reported by somerandomdev.


References:
https://github.com/roundcube/roundcubemail/releases/tag/1.6.12


BUILD in core/updates_testing:
roundcubemail-1.6.12-1.mga9.noarch

SRPM:
roundcubemail-1.6.12-1.mga9.src.rpm

Assignee: mageia => qa-bugs

Installed and tested without issues.

Tested a bunch of functions but it was a quick test.
Will continue to use and report back if there are any issues.

Tested with:
- Apache, PHP-FPM, MariaDB and Dovecot;
- PHP 8.4.15 from the backport repositories;
- Large email accounts, with GiB of emails;
- 2FA enabled using a 3rd party plugin: roundcubemail-plugin-twofactor_gauthenticator
All OK.



System: Mageia 9, x86_64, Intel(R) Core(TM) i5-4590 CPU @ 3.30GHz.



$ uname -a
Linux marte 6.6.116-server-1.mga9 #1 SMP PREEMPT_DYNAMIC Mon Nov  3 17:28:44 UTC 2025 x86_64 GNU/Linux
$ rpm -qa | grep roundcubemail
roundcubemail-1.6.12-1.mga9
$ php --version
PHP 8.4.15 (cli) (built: Nov 20 2025 09:34:22) (ZTS)
Copyright (c) The PHP Group
Zend Engine v4.4.15, Copyright (c) Zend Technologies
    with Zend OPcache v8.4.15, Copyright (c), by Zend Technologies
    with Xdebug v3.4.1, Copyright (c) 2002-2025, by Derick Rethans

FYI this advisory not have CVE list as is not provided in the upstream information

Keywords: (none) => advisory

Followed QA procedure and got as far as installation step 3, testing of connection to my hotmail account fails both for smtp and imap connection.
No time left today to investigate further, but at least the installer procedure worked that far.

CC: (none) => herman.viaene

Using this update for over 5 days without issues. Giving this the OK.
Please undo if appropriate.

Whiteboard: (none) => MGA9-64-OK

(In reply to PC LX from comment #5)
> Using this update for over 5 days without issues. Giving this the OK.
> Please undo if appropriate.

I really think you know this beast better than us

CC: (none) => andrewsfarm

Agreed. Validating.

Keywords: (none) => validated_update
CC: (none) => sysadmin-bugs

I added the missing CVE-2025-68460 & CVE-2025-68461 to the advisory, which look like the ones fixed here.

CVE: (none) => CVE-2025-68460, CVE-2025-68461
CC: (none) => dan

An update for this issue has been pushed to the Mageia Updates repository.

https://advisories.mageia.org/MGASA-2025-0332.html

Resolution: (none) => FIXED
Status: NEW => RESOLVED