[From nobody Mon Apr 6 16:05:09 2026 Received: (at submit) by bugs.debian.org; 18 Mar 2026 16:19:39 +0000 X-Spam-Checker-Version: SpamAssassin 4.0.1-bugs.debian.org_2005_01_02 (2024-03-25) on buxtehude.debian.org X-Spam-Level: X-Spam-Status: No, score=-114.1 required=4.0 tests=BAYES_00, BODY_INCLUDES_CONTROL,DKIMWL_WL_HIGH,DKIM_SIGNED,DKIM_VALID, DKIM_VALID_AU,DKIM_VALID_EF,FOURLA,FROMDEVELOPER,MD5_SHA1_SUM, SPF_HELO_NONE,SPF_NONE,UNPARSEABLE_RELAY,USER_IN_DKIM_WELCOMELIST, WEBMAIL,XMAILER_REPORTBUG autolearn=ham autolearn_force=no version=4.0.1-bugs.debian.org_2005_01_02 X-Spam-Bayes: score:0.0000 Tokens: new, 39; hammy, 150; neutral, 100; spammy, 0. spammytokens: hammytokens:0.000-+--Hx-spam-relays-external:sk:stravin, 0.000-+--H*RT:sk:stravin, 0.000-+--Hx-spam-relays-external:311, 0.000-+--H*RT:311, 0.000-+--H*RT:108 Return-path: <guilhem@debian.org> Received: from stravinsky.debian.org ([2001:41b8:202:deb::311:108]:46352) by buxtehude.debian.org with esmtps (TLS1.3:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.96) (envelope-from <guilhem@debian.org>) id 1w2tcR-00Gq1D-0d for submit@bugs.debian.org; Wed, 18 Mar 2026 16:19:39 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=debian.org; s=smtpauto.stravinsky; h=X-Debian-User:Date:Message-ID:Subject:To:From: Content-Transfer-Encoding:MIME-Version:Content-Type:Reply-To:Cc:Content-ID: Content-Description:In-Reply-To:References; bh=bm8/wOEpKa53R9crD8vAu2LjfKbfoNgn9WCeAoZsotI=; b=Wr7QCMuyCKNTZDgICLnRbwJ6nt S0XB0OKZwy0WknDFiHZRA2Yl0z18DwewTw/Vl+0VoaClvWWv8dqkrTfvPh5TqDFl6fxu+5Ie973Ag 6vug1+Xtg8yU388gqNbjD7ir/dC9L1P8bc98c0SzjlNizYK3oAy6A4m/1StbpoWy7IdIheOzebcPz OwNRSgmlT7kyf7IKzb5oK+Z86SIv/IxJh5GOe++RBDBHy1puPG89rNV0fHCDhPk7S2cJ7eQZid8OW Ppxfp6HGDPsqChoGteCnu+i2bgW10e7MO+0aN73Nd2Q3TGX9bAg7fyI+yW6/X4IF5ZcoezaUKFZLa 7TI0n9Jw==; Received: from authenticated user by stravinsky.debian.org with esmtpsa (TLS1.3:ECDHE_X25519__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.94.2) (envelope-from <guilhem@debian.org>) id 1w2tcQ-003mXx-LW; Wed, 18 Mar 2026 16:19:37 +0000 Received: by localhost.localdomain (Postfix, from userid 1000) id 78DAC42004D; Wed, 18 Mar 2026 17:19:35 +0100 (CET) Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: base64 From: Guilhem Moulin <guilhem@debian.org> To: Debian Bug Tracking System <submit@bugs.debian.org> Subject: roundcube: Multiple security vulnerabilities Message-ID: <177385077545.2498512.11121617466379237120.reportbug@odin.guilhem.org> X-Mailer: reportbug 13.2.0 Date: Wed, 18 Mar 2026 17:19:35 +0100 X-Debian-User: guilhem Delivered-To: submit@bugs.debian.org U291cmNlOiByb3VuZGN1YmUKVmVyc2lvbjogMS42LjEzK2Rmc2ctMQpTZXZlcml0eTogaW1wb3J0 YW50ClRhZ3M6IHNlY3VyaXR5ClgtRGViYnVncy1DYzogRGViaWFuIFNlY3VyaXR5IFRlYW0gPHRl YW1Ac2VjdXJpdHkuZGViaWFuLm9yZz4KCkNvbnRyb2w6IGZvdW5kIC0xIDEuNi4xMytkZnNnLTAr ZGViMTN1MQpDb250cm9sOiBmb3VuZCAtMSAxLjYuNStkZnNnLTErZGViMTJ1NwpDb250cm9sOiBm b3VuZCAtMSAxLjQuMTUrZGZzZy4xLTErZGViMTF1NwpUYWdzOiBzZWN1cml0eSB1cHN0cmVhbQpY LURlYmJ1Z3MtQ2M6IERlYmlhbiBTZWN1cml0eSBUZWFtIDx0ZWFtQHNlY3VyaXR5LmRlYmlhbi5v cmc+CgpSb3VuZGN1YmUgd2VibWFpbCB1cHN0cmVhbSBoYXMgcmVjZW50bHkgcmVsZWFzZWQgMS42 LjE0IFswXSB3aGljaCBmaXhlcwp0aGUgZm9sbG93aW5nIHNlY3VyaXR5IHZ1bG5lcmFiaWxpdGll czoKCiAgMS4gUHJlLWF1dGggYXJiaXRyYXJ5IGZpbGUgd3JpdGUgdmlhIHVuc2FmZSBkZXNlcmlh bGl6YXRpb24gaW4KICAgICByZWRpcy9tZW1jYWNoZSBzZXNzaW9uIGhhbmRsZXIsIHJlcG9ydGVk IGJ5IHkwdXMuCiAgICAgaHR0cHM6Ly9naXRodWIuY29tL3JvdW5kY3ViZS9yb3VuZGN1YmVtYWls L2NvbW1pdC82ZDU4NmNmYTRkOGEzMWY3OTU3ZjdhNDQ1YWFlZGQ1MjU5MmEwZTc0CgogIDIuIEJ1 ZyB3aGVyZSBhIHBhc3N3b3JkIGNvdWxkIGdldCBjaGFuZ2VkIHdpdGhvdXQgcHJvdmlkaW5nIHRo ZSBvbGQKICAgICBwYXNzd29yZCwgcmVwb3J0ZWQgYnkgZmx5ZHJhZ29uNzc3LgogICAgIGh0dHBz Oi8vZ2l0aHViLmNvbS9yb3VuZGN1YmUvcm91bmRjdWJlbWFpbC9jb21taXQvNmEyNzU2NzZhODA0 MzA4M2MwNWM5NjE5MTRkODMwYjc5ZTI0OTBkNAoKICAzLiBJTUFQIEluamVjdGlvbiArIENTUkYg YnlwYXNzIGluIG1haWwgc2VhcmNoLCByZXBvcnRlZCBieSBNYXJ0aWxhCiAgICAgU2VjdXJpdHkg UmVzZWFyY2ggVGVhbS4KICAgICBodHRwczovL2dpdGh1Yi5jb20vcm91bmRjdWJlL3JvdW5kY3Vi ZW1haWwvY29tbWl0LzVmZThhNjk5NTZhOTY4M2E0MjY5ZjNhZDJhNjhlMThkZWViZjhhMTUKCiAg NC4gUmVtb3RlIGltYWdlIGJsb2NraW5nIGJ5cGFzcyB2aWEgdmFyaW91cyBTVkcgYW5pbWF0ZSBh dHRyaWJ1dGVzLAogICAgIHJlcG9ydGVkIGJ5IG51bGxjYXRoZWRyYWwuCiAgICAgaHR0cHM6Ly9n aXRodWIuY29tL3JvdW5kY3ViZS9yb3VuZGN1YmVtYWlsL2NvbW1pdC84MmFiNWVjYTdiMzMyZmNl N2ExNzRiMmI5ODdmMDk1N2E2NjM3N2NkCgogIDUuIFJlbW90ZSBpbWFnZSBibG9ja2luZyBieXBh c3MgdmlhIGEgY3JhZnRlZCBib2R5IGJhY2tncm91bmQKICAgICBhdHRyaWJ1dGUsIHJlcG9ydGVk IGJ5IG51bGxjYXRoZWRyYWwuCiAgICAgaHR0cHM6Ly9naXRodWIuY29tL3JvdW5kY3ViZS9yb3Vu ZGN1YmVtYWlsL2NvbW1pdC9mZDBlOTgxNzhkYjVjNzNlYWE5M2QwMDViNTYxODc0OTIzZjliMGYw CgogIDYuIEZpeGVkIHBvc2l0aW9uIG1pdGlnYXRpb24gYnlwYXNzIHZpYSB1c2Ugb2YgYCFpbXBv cnRhbnRgLCByZXBvcnRlZAogICAgIGJ5IG51bGxjYXRoZWRyYWwuCiAgICAgaHR0cHM6Ly9naXRo dWIuY29tL3JvdW5kY3ViZS9yb3VuZGN1YmVtYWlsL2NvbW1pdC8yMjY4MTFhMWM5NzQyNzFkYmVk Y2E3MjY3MjkyM2FiYWZmODE5MWMwCgogIDcuIFhTUyBpc3N1ZSBpbiBhIEhUTUwgYXR0YWNobWVu dCBwcmV2aWV3LCByZXBvcnRlZCBieSBhaWtpZG9fc2VjdXJpdHkuCiAgICAgaHR0cHM6Ly9naXRo dWIuY29tL3JvdW5kY3ViZS9yb3VuZGN1YmVtYWlsL2NvbW1pdC8xYjMwZWRmNTM2OTY2OGM5MmZl OTFkYWUzZDUyZTQ3N2M4MDhhYTRmCgogIDguIFNTUkYgKyBJbmZvcm1hdGlvbiBEaXNjbG9zdXJl IHZpYSBzdHlsZXNoZWV0IGxpbmtzIHRvIGEgbG9jYWwKICAgICBuZXR3b3JrIGhvc3RzLCByZXBv cnRlZCBieSBHZW9yZ2lvcyBUc2ltcGlkYXMuCiAgICAgaHR0cHM6Ly9naXRodWIuY29tL3JvdW5k Y3ViZS9yb3VuZGN1YmVtYWlsL2NvbW1pdC81NzliNjhlZmY5MDY1MGE1Yzc4MmUxNTNkZWJkNjZj NzY1NjQ4OTQyCgpVcHN0cmVhbSdzIHNvbHV0aW9uIGZvciB0aGUgbGFzdCBpc3N1ZSBhZGRzIGEg bmV3IHJ1bnRpbWUgZGVwZW5kZW5jeSBtbG9jYXRpL2lwLWxpYiDiiaUxLjIyCndoaWNoIHVuZm9y dHVuYXRlbHkgaXMgbm90IGluIERlYmlhbiB5ZXQuICBJIGNhbiB1cGxvYWQgaXQgdG8gc2lkIGFz CnBhcnQgb2YgdGhlIFBFQVIgdGVhbSwgYnV0IG9sZGVyIHN1aXRlcyB3aWxsIG5lZWQgYW5vdGhl ciBzb2x1dGlvbi4KCkFGQUlLIG5vIENWRS1JRCBoYXZlIGJlZW4gcHVibGlzaGVkIGZvciB0aGVz ZSBpc3N1ZXMuICBJIGp1c3QgcmVxdWVzdGVkIHNvbWUuCi0tIApHdWlsaGVtLgoKWzBdIGh0dHBz Oi8vcm91bmRjdWJlLm5ldC9uZXdzLzIwMjYvMDMvMTgvc2VjdXJpdHktdXBkYXRlcy0xLjctcmM1 LTEuNi4xNC0xLjUuMTYK ]