[From nobody Sun Jul 5 17:07:07 2026 Received: (at 1141495-close) by bugs.debian.org; 5 Jul 2026 16:04:21 +0000 X-Spam-Checker-Version: SpamAssassin 4.0.1-bugs.debian.org_2005_01_02 (2024-03-25) on buxtehude.debian.org X-Spam-Level: X-Spam-Status: No, score=-113.9 required=4.0 tests=ALL_TRUSTED,BAYES_00, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,FOURLA, FVGT_m_MULTI_ODD,HAS_BUG_NUMBER,MD5_SHA1_SUM,PDS_BTC_ID,PGPSIGNATURE, SPF_HELO_PASS,SPF_PASS,USER_IN_DKIM_WELCOMELIST autolearn=ham autolearn_force=no version=4.0.1-bugs.debian.org_2005_01_02 X-Spam-Bayes: score:0.0000 Tokens: new, 13; hammy, 150; neutral, 295; spammy, 0. spammytokens: hammytokens:0.000-+--HX-Debian:DAK, 0.000-+--H*rp:D*ftp-master.debian.org, 0.000-+--HX-DAK:process-upload, 0.000-+--UD:debian.tar.xz, 0.000-+--H*r:sk:fasolo. Return-path: <envelope@ftp-master.debian.org> Received: from mailly.debian.org ([2001:41b8:202:deb:6564:a62:52c3:4b72]:59248) by buxtehude.debian.org with esmtps (TLS1.3:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.96) (envelope-from <envelope@ftp-master.debian.org>) id 1wgPKP-003ae0-2j for 1141495-close@bugs.debian.org; Sun, 05 Jul 2026 16:04:21 +0000 Received: via submission from C=NA, ST=NA, L=Ankh Morpork, O=Debian SMTP, OU=Debian SMTP CA, CN=fasolo.debian.org, EMAIL=hostmaster@fasolo.debian.org (verified) by mailly.debian.org with esmtps (TLS1.3:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.96) (envelope-from <envelope@ftp-master.debian.org>) id 1wgPKO-00169K-0K for 1141495-close@bugs.debian.org; Sun, 05 Jul 2026 16:04:20 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=ftp-master.debian.org; s=smtpauto.fasolo; h=Date:Message-Id:Content-Type: Subject:MIME-Version:To:Reply-To:From:Cc:Content-Transfer-Encoding:Content-ID :Content-Description:In-Reply-To:References; bh=HbQoRJeDp1GCHkuNQ/z5R2GM5y8Id50gQpzIgmLdkeo=; b=LJoOTQG7oEezdyoRzuM88MjLl4 vQ5wR24gK6TVEk+ffEHa7LnhIaPBv/1SAqzJVzPY0FS26ET9KV1hu/8ULBt+iln2l2NmmjYY1VE64 XxOiqci7hUVk9bQ6QIBNXMyhlwxvyrr0gIvQeIFgbwYypwhgOKCiUWp9QRl876X3XvkCAWBaBq60o lDjU9J5Dt3UNIEEthDlzBlC9CpK4O5cWDZabF0SO2eEHBDZfJuQhOQqFCR0DdY1UPwWkTFOymWhNQ bE9O69oZwszji+7S9EC4dfRupLNtOOHH2ahrmgbbxkpZvpTRuKW4bgJpMgJzUFmipd9/efSsVr/Mm ak3h1l/A==; Received: from dak by fasolo.debian.org with local (Exim 4.98.2) (envelope-from <envelope@ftp-master.debian.org>) id 1wgPKN-0000000Ekng-1vg3; Sun, 05 Jul 2026 16:04:19 +0000 From: Debian FTP Masters <ftpmaster@ftp-master.debian.org> Reply-To: Guilhem Moulin <guilhem@debian.org> To: 1141495-close@bugs.debian.org X-DAK: dak process-upload X-Debian: DAK X-Debian-Package: roundcube Debian: DAK Debian-Changes: roundcube_1.6.17+dfsg-1_source.changes Debian-Source: roundcube Debian-Version: 1.6.17+dfsg-1 Debian-Architecture: source Debian-Suite: unstable Debian-Archive-Action: accept MIME-Version: 1.0 Subject: Bug#1141495: fixed in roundcube 1.6.17+dfsg-1 Content-Type: multipart/signed; micalg="pgp-sha256"; protocol="application/pgp-signature"; boundary="===============7521689600089393830==" Message-Id: <E1wgPKN-0000000Ekng-1vg3@fasolo.debian.org> Date: Sun, 05 Jul 2026 16:04:19 +0000 X-CrossAssassin-Score: 2 --===============7521689600089393830== Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Source: roundcube Source-Version: 1.6.17+dfsg-1 Done: Guilhem Moulin <guilhem@debian.org> We believe that the bug you reported is fixed in the latest version of roundcube, which is due to be installed in the Debian FTP archive. A summary of the changes between this version and the previous one is attached. Thank you for reporting the bug, which will now be closed. If you have further comments please address them to 1141495@bugs.debian.org, and the maintainer will reopen the bug report if appropriate. Debian distribution maintenance software pp. Guilhem Moulin <guilhem@debian.org> (supplier of updated roundcube package) (This message was generated automatically at their request; if you believe that there is a problem with it please contact the archive administrators by mailing ftpmaster@ftp-master.debian.org) -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Sun, 05 Jul 2026 17:26:53 +0200 Source: roundcube Architecture: source Version: 1.6.17+dfsg-1 Distribution: unstable Urgency: high Maintainer: Debian Roundcube Maintainers <pkg-roundcube-maintainers@alioth-li= sts.debian.net> Changed-By: Guilhem Moulin <guilhem@debian.org> Closes: 1138086 1141495 Changes: roundcube (1.6.17+dfsg-1) unstable; urgency=3Dhigh . * New upstream security and bugfix release (closes: #1141495). + Fix infinite loop in TNEF (winmail.dat) decoder. + Fix various vulnerabilities in the password plugin using session-injected username. + Fix CVE-2026-54432: Stored XSS via unescaped attachment MIME type on t= he attachment-validation warning page. + Fix SSRF bypass via specific local address URLs. + Fix CVE-2026-54433: Zero-click stored XSS in plain-text rendering. + Fix DoS via crafted compressed-RTF size in the TNEF (winmail.dat) file. + Enigma: Add support for automatic public key lookup (import) using HKP v1 protocol. + Enigma: Add support for Kolab's Web Of Anti-Trust (WOAT) feature. * d/p/Avoid-dependency-on-new-package-mlocati-ip-lib.patch: Improve patch and drop type annotations to restore compatibility with PHP<8 (closes: #1138086). Checksums-Sha1: cc90069cc1df4a571acd39ce7d8b196b3729a2b2 3845 roundcube_1.6.17+dfsg-1.dsc c42a03f7b7f449f7ec9023843d775b66e2887e31 126836 roundcube_1.6.17+dfsg.orig-t= inymce-langs.tar.xz a14b229b6767817fb36d85c6c22b700e81fcc74a 1928888 roundcube_1.6.17+dfsg.orig-= tinymce.tar.xz 1f753251c7e378540cea602af4a7f5db415764fa 2906816 roundcube_1.6.17+dfsg.orig.= tar.xz 3e31aaa811424ffebdd43e601f014e46a56d6b6c 159116 roundcube_1.6.17+dfsg-1.debi= an.tar.xz cc5c4a419d387e71bd5a5047ed7b18e3f518ce0d 6227 roundcube_1.6.17+dfsg-1_source= .buildinfo Checksums-Sha256: 5ddbaa4318bc081ac0b28d46522d702fb3a89220ca26038c7e20e4588ee4a65b 3845 roundc= ube_1.6.17+dfsg-1.dsc a9e0dcf588cdfd398b1ffacb63d3cc6cf2132785adcf98b9bc3cb7b23f9f1f6e 126836 roun= dcube_1.6.17+dfsg.orig-tinymce-langs.tar.xz 870c74fc7fe5f66929a8f45b7340be3d542d94ef5786d92393bfbf687c57b1fa 1928888 rou= ndcube_1.6.17+dfsg.orig-tinymce.tar.xz c32cae39892d8936f1b07712e0cda3f435d311cd095e6d949d8e62c473ae1426 2906816 rou= ndcube_1.6.17+dfsg.orig.tar.xz d4a4cfd1cc4c48007af7e059cb201ba800b92ec1185f7f3d2f0c5429e25e9367 159116 roun= dcube_1.6.17+dfsg-1.debian.tar.xz 87e264d6e5a915851d22b91aeaab2652671903f08c8f57690fb931aaa0edceef 6227 roundc= ube_1.6.17+dfsg-1_source.buildinfo Files: b9a10be22b02a0bf26798952f2d58b30 3845 web optional roundcube_1.6.17+dfsg-1.d= sc 14e66bb6839218d4add3e1fbea68952d 126836 web optional roundcube_1.6.17+dfsg.o= rig-tinymce-langs.tar.xz d1198f417f0ae874dedee8a12e7c8713 1928888 web optional roundcube_1.6.17+dfsg.= orig-tinymce.tar.xz dc32d01c80607b6c6ab3a206e354e584 2906816 web optional roundcube_1.6.17+dfsg.= orig.tar.xz 66ef61fd6e2c2ba68d5731a617f3c9d1 159116 web optional roundcube_1.6.17+dfsg-1= .debian.tar.xz fa5e7976140601b140b3b19a0214fb9d 6227 web optional roundcube_1.6.17+dfsg-1_s= ource.buildinfo -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEERpy6p3b9sfzUdbME05pJnDwhpVIFAmpKebwACgkQ05pJnDwh pVKMjQ/9FASx8Pq8QeLmityAdMYXFizs6anN2uBThC1gIvWtRrL6bogVQTbUILWM ISZKtGsxgSn6MA4vKU2ILbJdidb1mN+Hc+7TdOaWqxQEcX+tsFzuV4oJbAhyurzM rm+uPytsTEekBfTBjYTbNaLsj4WE+0qHTLnGjUgHGk3DK9w48tvIBoJnxWYIuq1D /7n2OP8sPEsXlmuey47wBF7xhvgj2krBOpDOPjAoROuNK0foc3zcFmSvDDx/2Ldv ooE0DUkq/iQPcJw/1a+UrxqyIYNoD40qq7avTF4uF6vRgta2mNOyOBHwMcioPqlq RvUYLlMp18vy9TtkK9HFcnN9PEAuiNpGPbS5tNhxXXfT9uZpZTgHqBgIPd0UfAM4 Oe61c06IRA9XYHayR8zpabguRsNn2GdJxJO74HXzI9Q5gxy1WW8lAL9KR9IuUsEV eZNHvUtELqth2O/c1xWuLurYxZAiFjCtzK7Xg4mLT18CEXduR24WrQU5mFZN4ApQ c+tQNdSY3XiQ+JcQY9klPdjb0PborZH2PShLUOAYUTR9R2XZlMvuzRIogaxnel2v YPO8HA6QrVZNCmvfVTkkwJBRiywXfCqKPSmjHJiEaSTQVdqJ8F1o2vLI+3h0ECyw h/wLup2HG2YhezdBw9g8xwZCtL4OAP2In3HCNd6cnJaLdLjSFGo=3D =3DdyWy -----END PGP SIGNATURE----- --===============7521689600089393830== Content-Type: application/pgp-signature -----BEGIN PGP SIGNATURE----- iHUEABYIAB0WIQTziqJOuF8J+ZI8pJSb9qggYcy5IQUCakqAgwAKCRCb9qggYcy5 ISNzAQDH77eMAXAmbSI9w54NvuJBK2UytzLU5kuny9zNXL6wqgD9EemimOzQAgmt T4FUUNOrc7FFSE6diErdjjDOp8SZSA0= =tnuC -----END PGP SIGNATURE----- --===============7521689600089393830==-- ]