# openSUSE-SU-2023:0285-1: Security update for roundcubemail > An XSS vulnerability in Roundcube webmail allows attackers to execute scripts in victim browsers via crafted plain text messages. - **Severity:** Not scored - **Exploited in the wild:** Not known - **Login needed:** Any signed-in user - **Attackable:** Over the internet - **Victim action needed:** A user has to click or open something - **Fix available:** Yes - **Published:** 2 Oct 2023 ## What is openSUSE-SU-2023:0285-1? openSUSE-SU-2023:0285-1 is a cross-site scripting vulnerability in roundcubemail, published on 2 Oct 2023. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link. ### Official description This update for roundcubemail fixes the following issues: Update to 1.6.3 (boo#1215433) * Fix bug where installto.sh/update.sh scripts were removing some essential options from the config file (#9051) * Update jQuery-UI to version 1.13.2 (#9041) * Fix regression that broke use_secure_urls feature (#9052) * Fix potential PHP fatal error when opening a message with message/rfc822 part (#8953) * Fix bug where a duplicate tag in HTML email could cause some parts being cut off (#9029) * Fix bug where a list of folders could have been sorted incorrectly (#9057) * Fix regression where LDAP addressbook 'filter' option was ignored (#9061) * Fix wrong order of a multi-folder search result when sorting by size (#9065) * Fix so install/update scripts do not require PEAR (#9037) * Fix regression where some mail parts could have been decoded incorrectly, or not at all (#9096) * Fix handling of an error case in Cyrus IMAP BINARY FETCH, fallback to non-binary FETCH (#9097) * Fix PHP8 deprecation warning in the reconnect plugin (#9083) * Fix 'Show source' on mobile with x_frame_options = deny (#9084) * Fix various PHP warnings (#9098) * Fix deprecated use of ldap_connect() in password's ldap_simple driver (#9060) * Fix cross-site scripting (XSS) vulnerability in handling of linkrefs in plain text messages Update to 1.6.2 * Add Uyghur localization * Fix regression in OAuth request URI caused by use of REQUEST_URI instead of SCRIPT_NAME as a default (#8878) * Fix bug where false attachment reminder was displayed on HTML mail with inline images (#8885) * Fix bug where a non-ASCII character in app.js could cause error in javascript engine (#8894) * Fix JWT decoding with url safe base64 schema (#8890) * Fix bug where .wav instead of .mp3 file was used for the new mail notification in Firefox (#8895) * Fix PHP8 warning (#8891) * Fix support for Windows-31J charset (#8869) * Fix so LDAP VLV option is disabled by default as documented (#8833) * Fix so an email address with name is supported as input to the managesieve notify :from parameter (#8918) * Fix Help plugin menu (#8898) * Fix invalid onclick handler on the logo image when using non-array skin_logo setting (#8933) * Fix duplicate recipients in 'To' and 'Cc' on reply (#8912) * Fix bug where it wasn't possible to scroll lists by clicking middle mouse button (#8942) * Fix bug where label text in a single-input dialog could be partially invisible in some locales (#8905) * Fix bug where LDAP (fulltext) search didn't work without 'search_fields' in config (#8874) * Fix extra leading newlines in plain text converted from HTML (#8973) * Fix so recipients with a domain ending with .s are allowed (#8854) * Fix so vCard output does not contain non-standard/redundant TYPE=OTHER and TYPE=INTERNET (#8838) * Fix QR code images for contacts with non-ASCII characters (#9001) * Fix PHP8 warnings when using list_flags and list_cols properties by plugins (#8998) * Fix bug where subfolders could loose subscription on parent folder rename (#8892) * Fix connecting to LDAP using an URI with ldapi:// scheme (#8990) * Fix insecure shell command params handling in cmd_learn driver of markasjunk plugin (#9005) * Fix bug where some mail headers didn't work in cmd_learn driver of markasjunk plugin (#9005) * Fix PHP fatal error when importing vcf file using PHP 8.2 (#9025) * Fix so output of log_date_format with microseconds contains time in server time zone, not UTC ## Which versions are affected by openSUSE-SU-2023:0285-1? | Package | Ecosystem | Affected | Fixed in | | --- | --- | --- | --- | | `roundcubemail` | SUSE:Package Hub 15 SP5 | All versions | 1.6.3-bp155.2.3.1 | | `roundcubemail` | openSUSE:Leap 15.5 | All versions | 1.6.3-bp155.2.3.1 | ## How do I fix openSUSE-SU-2023:0285-1? Upgrade to a fixed version. ## Is openSUSE-SU-2023:0285-1 being exploited? There is no known exploitation of openSUSE-SU-2023:0285-1 in the wild and no public exploit code. ## Fix prompt for AI coding agents ```text Check this codebase for openSUSE-SU-2023:0285-1 and fix it if it is affected. What it is: openSUSE-SU-2023:0285-1 is a cross-site scripting vulnerability in roundcubemail, published on 2 Oct 2023. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link. Exploitation: There is no known exploitation of openSUSE-SU-2023:0285-1 in the wild and no public exploit code. Affected product: roundcubemail. No package-level version data is available, so check the vendor advisory linked from the reference page. Task: 1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies. 2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it. 3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead. 4. Run the tests and summarise what changed and why. 5. If nothing in the project is affected, say so and change nothing. Reference: https://insights.sbomify.com/openSUSE-SU-2023-0285-1/ (Markdown: https://insights.sbomify.com/openSUSE-SU-2023-0285-1/index.md) ``` ## Sources - OSV: https://osv.dev/vulnerability/openSUSE-SU-2023:0285-1 --- From sbomify Insights: https://insights.sbomify.com/openSUSE-SU-2023-0285-1/ Summaries are generated and may contain mistakes; the official description above is the record.