Reserved in error; never associated with a vulnerability.

Reserved in error; never associated with a vulnerability.

Reserved in error; never associated with a vulnerability.

Reserved in error; never associated with a vulnerability.

Reserved in error; never associated with a vulnerability.

Reserved in error; never associated with a vulnerability.

Reserved in error; never associated with a vulnerability.

Reserved in error; never associated with a vulnerability.

Reserved in error; never associated with a vulnerability.

Reserved in error; never associated with a vulnerability.

Reserved in error; never associated with a vulnerability.

Reserved in error; never associated with a vulnerability.

Reserved in error; never associated with a vulnerability.

Reserved in error; never associated with a vulnerability.

Reserved in error; never associated with a vulnerability.

Reserved in error; never associated with a vulnerability.

Privilege escalation in the DOM: Navigation component

Privilege escalation in the DOM: Navigation component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.

roundcubemail: roundcubemail: Server-Side Request Forgery via address filter bypass

Roundcube Webmail 1.6.14 before 1.6.20 and 1.7.0 before 1.7.5 is affected by a server-side request forgery filter bypass. The network blocklist used by rcube_utils::is_local_url() omitted the RFC 6052 NAT64 prefix 64:ff9b::/96, the RFC 8215 local-use NAT64 prefix 64:ff9b:1::/48 and the unspecified address ::/128, so URLs such as http://[64:ff9b::7f00:1]/ passed the filter and reached loopback, link-local and cloud metadata addresses. Upstream fixed this in the commit “Fix SSRF filter (is_local_url()) bypass via NAT64 64:ff9b::/96”.

roundcubemail: roundcubemail: Mail header injection via crafted From display name in bounce action

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability in the Bounce (resend) action. rcube_mime::decode_address_list() did not strip control characters from the decoded display name, so a received message whose From display-name carries CRLF sequences in an encoded word could inject arbitrary headers into the message emitted when the user bounces it. Upstream fixed this in the commit “Fix mail header injection via the From display-name in the Bounce (resend) action”.

roundcubemail: Roundcube Webmail: Interface spoofing via CSS scoping bypass in HTML messages

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a CSS scoping bypass in HTML messages. rcube_utils::mod_css_styles() did not treat an at-rule prologue such as @layer a; as a selector boundary, and did not handle selectors beginning with ::, so selectors following an at-rule were left unscoped and applied to the whole Roundcube interface instead of being confined to the message body. This allows an HTML message to restyle application chrome for UI redressing and spoofing. Upstream fixed this in the commit “Fix CSS scoping bypass in HTML messages using at-rules”.