Roundcube has released two security updates, version 1.7.6 and 1.6.21, addressing 17 recently disclosed vulnerabilities, including issues related to open redirects, IMAP command injection, and denial-of-service attacks. The updates were issued simultaneously to ensure both the mainline and long-term support (LTS) branches remain secure, with lead developer Alec Machniak urging users to upgrade immediately, particularly those still using the aging 1.6 LTS line which is nearing retirement. The vulnerabilities were reported by an anonymous group of researchers who have consistently contributed to previous updates, highlighting ongoing security challenges due to the nature of processing untrusted email content. Roundcube is pushing for upgrades to version 1.7 as older versions increase the risk of exploitation, with significant vulnerabilities already identified in previous iterations affecting numerous installations

Roundcube Releases 17 Security Fixes in 1.7.6 and 1.6.21

Roundcube shipped two security updates at once: 1.7.6 for the mainline and 1.6.21 for its long-term-support branch, each fixing 17 recently disclosed flaws. The patches cover open redirects, IMAP command injection, header and Sieve script injection, SSRF, CSRF bypasses, a runaway-CPU denial-of-service, and an ImageMagick flaw that could lead to code execution. An anonymous collective known as Squirt1e, Atum, N0b0dy and Gh0u1L5 earned credit for eight of the seventeen fixes, building on a long history of working with the project. Lead developer Alec Machniak once again urged production sites to update immediately, while warning that the aging four-year-old 1.6 LTS line is being pushed toward retirement.

Roundcube Releases 17 Security Fixes in 1.7.6 and 1.6.21 @ Linux Compatible