Roundcube 1.1.4 released - SECURITY UPDATE!

[unihostbrasil]

This is a security update to the stable version 1.1. It contains some important bug fixes one of which seals a potential path traversal vulnerability recently reported by High-Tech Bridge Security Research Lab. A second security improvement adds some measures against brute-force attacks.

CHANGELOG:
http://trac.roundcube.net/wiki/Changelog#RELEASE1.1.4

 

[zEitEr]

Hello,

Just got an email from cron with this error:

--2015-12-28 03:29:39--  [URL]http://files.directadmin.com/services/all/roundcube/roundcubemail-1.1.4.tar.gz[/URL]
Resolving files.directadmin.com... 69.162.69.58, 216.144.254.90, 208.167.226.3
Connecting to files.directadmin.com|69.162.69.58|:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 4578600 (4.4M) [application/x-gzip]
Saving to: `/usr/local/directadmin/custombuild/roundcubemail-1.1.4.tar.gz'

...
...
...

2015-12-28 03:29:57 (267 KB/s) - `/usr/local/directadmin/custombuild/roundcubemail-1.1.4.tar.gz' saved [4578600/4578600] 
Editing roundcube configuration...
Roundcube 1.1.4 has been installed successfully.
 
Warning: Unexpected character in input:  '\' (ASCII=92) state=1 in /var/www/html/roundcubemail-1.1.4/bin/update.sh on line 214
 
Warning: Unexpected character in input:  '\' (ASCII=92) state=1 in /var/www/html/roundcubemail-1.1.4/bin/update.sh on line 214
 
Parse error: syntax error, unexpected T_STRING in /var/www/html/roundcubemail-1.1.4/bin/update.sh on line 214

Did not go into details yet, hope it does not break much.

 

[blog]

I get this error:

2015-12-30 16:54:33 (8.69 MB/s) - `/usr/local/directadmin/custombuild/roundcubemail-1.1.4.tar.gz' saved [4578600/4578600]

MD5 Checksum on roundcubemail-1.1.4.tar.gz passed.
/usr/bin/mysqlshow: unknown variable 'wait_timeout=300'
Inserting data to mysql and creating database/user for roundcube...
mysql: unknown variable 'wait_timeout=300'
mysql: unknown variable 'wait_timeout=300'
ERROR 1045 (28000): Access denied for user 'da_roundcube'@'localhost' (using password: YES)
Database created, da_roundcube password is lk21rxy7qO7XHd
Editing roundcube configuration...
Roundcube 1.1.4 has been installed successfully.
Executing database schema update.
ERROR: SQLSTATE[HY000] [1045] Access denied for user 'da_roundcube'@'localhost' (using password: YES)Error 500: Error connecting to database: SQLSTATE[HY000] [1045] Access denied for user 'da_roundcube'@'localhost' (using password: YES)
ERROR: SQLSTATE[HY000] [1045] Access denied for user 'da_roundcube'@'localhost' (using password: YES)Error 500: No DB connection