Threats affecting pkg:rpm/suse/roundcubemail

This update for roundcubemail fixes the following issues: Changes in roundcubemail: - update to 1.6.16 + Fix potential too long value in IMAP ID command (#10136) + Security: Fix stored XSS/HTML/CSS injection in subject field of the draft restore dialog [CVE-2026-48849] [bsc#1266337] + Security: Fix CSS injection bypass in HTML sanitizer via SVG 'animate attributeName="style"' [CVE-2026-48848] [bsc#1266336] + Security: Fix pre-auth SQL injection in virtuser_query plugin via preg_replace backslash escape bypass [CVE-2026-48842] [bsc#1266329] + Security: Fix SSRF bypass via specific local address URLs [CVE-2026-48843] [bsc#1266331] + Security: Fix bypass of remote image blocking via CSS var() [CVE-2026-48846] [bsc#1266334] + Security: Fix local/private URL fetch bypass when remote resources were not allowed [CVE-2026-48845] [bsc#1266333] + Security: Fix pre-auth arbitrary file delete via redis/memcache session poisoning bypass [CVE-2026-48847] [bsc#1266335] + Security: Fix code injection vulnerability - remove support for code evaluation in LDAP autovalues option [CVE-2026-48844] [bsc#1266332]

Multiple security vulnerabilities have been addressed in Roundcube Webmail stable version 1.6 through updates 1.6.11, 1.6.12, and 1.6.13. These include fixes for a post-authentication remote code execution via PHP object deserialization, cross-site scripting via SVG animate tags, information disclosure through the HTML style sanitizer, CSS injection, and remote image blocking bypass via SVG content. The vendor recommends updating all productive installations of Roundcube 1.6.x to version 1.6.13. Users should back up data before updating.