Описание
An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. Unsafe deserialization in the redis/memcache session handler may lead to arbitrary file write operations by unauthenticated attackers via crafted session data.
Пакеты
| Пакет | Статус | Версия исправления | Релиз | Тип |
|---|---|---|---|---|
| roundcube | fixed | 1.6.14+dfsg-1 | package | |
| roundcube | not-affected | bullseye | package |
Примечания
https://roundcube.net/news/2026/03/18/security-updates-1.7-rc5-1.6.14-1.5.14
Fixed by: https://github.com/roundcube/roundcubemail/commit/6d586cfa4d8a31f7957f7a445aaedd52592a0e74 (1.7-rc5)
Fixed by: https://github.com/roundcube/roundcubemail/commit/a4ead994d2f0ea92e4a1603196a197e0d5df1620 (1.6.14)
Fixed by: https://github.com/roundcube/roundcubemail/commit/618c5428edc69fb088e7ac6c89e506dd39df3fc2 (1.5.14)
Связанные уязвимости
An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. Unsafe deserialization in the redis/memcache session handler may lead to arbitrary file write operations by unauthenticated attackers via crafted session data.
An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. Unsafe deserialization in the redis/memcache session handler may lead to arbitrary file write operations by unauthenticated attackers via crafted session data.
Roundcube Webmail: Unsafe deserialization in the redis/memcache session handler
Уязвимость почтового клиента RoundCube Webmail, связанная с недостатками механизма десериализации, позволяющая нарушителю записать произвольные файлы