Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 769623 (CVE-2021-26925) - <mail-client/roundcube-1.4.11: XSS vulnerability (CVE-2021-26925)
Summary: <mail-client/roundcube-1.4.11: XSS vulnerability (CVE-2021-26925)
Alias: CVE-2021-26925
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal normal (vote)
Assignee: Gentoo Security
Whiteboard: B4 [noglsa]
Depends on:
Reported: 2021-02-08 22:32 UTC by Philippe Chaintreuil
Modified: 2021-03-01 20:52 UTC (History)
3 users (show)

See Also:
Package list:
mail-client/roundcube-1.4.11 amd64 arm ppc ppc64 sparc x86
Runtime testing required: No
nattka: sanity-check+


Note You need to log in before you can comment on or make changes to this bug.
Description Philippe Chaintreuil 2021-02-08 22:32:55 UTC
Roundcube 1.4.11 has been released.  It fixes an XSS bug.


Reproducible: Always
Comment 1 Andreas Sturmlechner gentoo-dev 2021-02-08 22:37:23 UTC
You're late, see commit 304a04be7c684287a2ef2a03969d5dc7c7f5bf77. ;)
Comment 3 Sam James archtester gentoo-dev Security 2021-02-09 09:45:32 UTC
Tell us when ready to stable.
Comment 4 Sam James archtester gentoo-dev Security 2021-02-24 21:10:29 UTC
Comment 5 Philippe Chaintreuil 2021-02-25 01:01:11 UTC
Just as a data point, I've been running 1.4.11 since Feb 8th without an issue.  (But I'm not the maintainer.)
Comment 6 Aaron W. Swenson gentoo-dev 2021-02-25 14:30:04 UTC
Please stabilize the following target:
=mail-client/roundcube-1.4.11 ~amd64 ~arm ~ppc ~ppc64 ~sparc ~x86
Comment 7 Sam James archtester gentoo-dev Security 2021-02-27 10:08:00 UTC
amd64 arm ppc ppc64 sparc x86 (ALLARCHES) done

all arches done
Comment 8 Larry the Git Cow gentoo-dev 2021-02-27 10:44:23 UTC
The bug has been referenced in the following commit(s):

commit d5f856ca212bcdbe2096375e922030ab2e65965e
Author:     Aaron W. Swenson <>
AuthorDate: 2021-02-27 10:40:27 +0000
Commit:     Aaron W. Swenson <>
CommitDate: 2021-02-27 10:44:04 +0000

    mail-client/roundcube: Cleanup
    Signed-off-by: Aaron W. Swenson <>

 mail-client/roundcube/Manifest                |  2 -
 mail-client/roundcube/roundcube-1.4.10.ebuild | 96 ---------------------------
 mail-client/roundcube/roundcube-1.4.8.ebuild  | 73 --------------------
 3 files changed, 171 deletions(-)
Comment 9 Sam James archtester gentoo-dev Security 2021-03-01 20:52:28 UTC