Roundcube -- Multiple vulnerabilities

The Roundcube project reports:

pre-auth arbitrary file write via unsafe deserialization in redis/memcache session handler

password could get changed without providing the old password

IMAP Injection + CSRF bypass in mail search

remote image blocking bypass via various SVG animate attributes

remote image blocking bypass via a crafted body background attribute

fixed position mitigation bypass via use of !important

XSS issue in a HTML attachment preview

SSRF + Information Disclosure via stylesheet links to a local network hosts

[source]