[From nobody Wed Jul 22 19:51:09 2026 Received: (at 1138086-close) by bugs.debian.org; 22 Jul 2026 18:50:00 +0000 X-Spam-Checker-Version: SpamAssassin 4.0.1-bugs.debian.org_2005_01_02 (2024-03-25) on buxtehude.debian.org X-Spam-Level: X-Spam-Status: No, score=-113.6 required=4.0 tests=ALL_TRUSTED,BAYES_00, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,FOURLA, FVGT_m_MULTI_ODD,HAS_BUG_NUMBER,MD5_SHA1_SUM,PDS_BTC_ID,PGPSIGNATURE, SPF_HELO_PASS,SPF_PASS,USER_IN_DKIM_WELCOMELIST autolearn=ham autolearn_force=no version=4.0.1-bugs.debian.org_2005_01_02 X-Spam-Bayes: score:0.0000 Tokens: new, 80; hammy, 150; neutral, 267; spammy, 0. spammytokens: hammytokens:0.000-+--HX-Debian:DAK, 0.000-+--H*rp:D*ftp-master.debian.org, 0.000-+--UD:debian.tar.xz, 0.000-+--H*r:sk:fasolo., 0.000-+--H*MI:fasolo Return-path: <envelope@ftp-master.debian.org> Received: from mailly.debian.org ([2001:41b8:202:deb:6564:a62:52c3:4b72]:56420) by buxtehude.debian.org with esmtps (TLS1.3:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.96) (envelope-from <envelope@ftp-master.debian.org>) id 1wmc12-00B362-1G for 1138086-close@bugs.debian.org; Wed, 22 Jul 2026 18:50:00 +0000 Received: via submission from C=NA, ST=NA, L=Ankh Morpork, O=Debian SMTP, OU=Debian SMTP CA, CN=fasolo.debian.org, EMAIL=hostmaster@fasolo.debian.org (verified) by mailly.debian.org with esmtps (TLS1.3:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.96) (envelope-from <envelope@ftp-master.debian.org>) id 1wmc12-004kml-0J for 1138086-close@bugs.debian.org; Wed, 22 Jul 2026 18:49:59 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=ftp-master.debian.org; s=smtpauto.fasolo; h=Date:Message-Id:Content-Type: Subject:MIME-Version:To:Reply-To:From:Cc:Content-Transfer-Encoding:Content-ID :Content-Description:In-Reply-To:References; bh=/jUm4YamDYtOBG9seexwYTGuHBeD1ov8t9QVUOWDJRI=; b=VybaIF/z9YPCTKkn4MmFbrLTPU Ji2lUeVWiVtZbn4LM9y6b4koGdsWGVp2MIdgUFzEzTQQKHDJr/k1r773xpJ3DGAFFgu6UK4IABtDz pn0wXFVayVEwlEuAi4qc4cNO7rFIqdL/vY4EeylgLyLbmlimke/goHCEtvqJWuBpTl83JPZSavjhV h/KfNUuWmdziPzVTOdXawY+Mg4e9ADw68hhf++ncJUhJoYCABBEjyjjaae6I3iBJfZpKd4qbVD31c 1vhcHY8bZkWSJ63w1Fdb7ioEIL32t+CcSVIpzrqQRPwnCwC7MyjrhyQ8WQr0ZRJyFcGXMlEoBqeuD +IXhpKBw==; Received: from dak by fasolo.debian.org with local (Exim 4.98.2) (envelope-from <envelope@ftp-master.debian.org>) id 1wmc10-00000006O9R-31nJ; Wed, 22 Jul 2026 18:49:58 +0000 From: Debian FTP Masters <ftpmaster@ftp-master.debian.org> Reply-To: Guilhem Moulin <guilhem@debian.org> To: 1138086-close@bugs.debian.org X-DAK: dak process-policy X-Debian: DAK X-Debian-Package: roundcube Debian: DAK Debian-Changes: roundcube_1.6.17+dfsg-0+deb13u1_source.changes Debian-Source: roundcube Debian-Version: 1.6.17+dfsg-0+deb13u1 Debian-Architecture: source Debian-Suite: proposed-updates Debian-Archive-Action: accept MIME-Version: 1.0 Subject: Bug#1138086: fixed in roundcube 1.6.17+dfsg-0+deb13u1 Content-Type: multipart/signed; micalg="pgp-sha256"; protocol="application/pgp-signature"; boundary="===============2962346478964737382==" Message-Id: <E1wmc10-00000006O9R-31nJ@fasolo.debian.org> Date: Wed, 22 Jul 2026 18:49:58 +0000 X-CrossAssassin-Score: 2 --===============2962346478964737382== Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Source: roundcube Source-Version: 1.6.17+dfsg-0+deb13u1 Done: Guilhem Moulin <guilhem@debian.org> We believe that the bug you reported is fixed in the latest version of roundcube, which is due to be installed in the Debian FTP archive. A summary of the changes between this version and the previous one is attached. Thank you for reporting the bug, which will now be closed. If you have further comments please address them to 1138086@bugs.debian.org, and the maintainer will reopen the bug report if appropriate. Debian distribution maintenance software pp. Guilhem Moulin <guilhem@debian.org> (supplier of updated roundcube package) (This message was generated automatically at their request; if you believe that there is a problem with it please contact the archive administrators by mailing ftpmaster@ftp-master.debian.org) -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Wed, 08 Jul 2026 12:46:28 +0200 Source: roundcube Architecture: source Version: 1.6.17+dfsg-0+deb13u1 Distribution: trixie-security Urgency: high Maintainer: Debian Roundcube Maintainers <pkg-roundcube-maintainers@alioth-li= sts.debian.net> Changed-By: Guilhem Moulin <guilhem@debian.org> Closes: 1138086 1141495 Changes: roundcube (1.6.17+dfsg-0+deb13u1) trixie-security; urgency=3Dhigh . * New upstream security and bugfix release (closes: #1141495). + Fix CVE-2026-62642: Infinite loop in TNEF (winmail.dat) decoder. + Fix CVE-2026-62644: Various vulnerabilities in the password plugin usi= ng session-injected username. + Fix CVE-2026-54432: Stored XSS via unescaped attachment MIME type on t= he attachment-validation warning page. + Fix CVE-2026-62643: SSRF bypass via specific local address URLs. + Fix CVE-2026-54433: Zero-click stored XSS in plain-text rendering. + Fix CVE-2026-62641: DoS via crafted compressed-RTF size in the TNEF (winmail.dat) file. + Enigma: Add support for automatic public key lookup (import) using HKP v1 protocol. + Enigma: Add support for Kolab's Web Of Anti-Trust (WOAT) feature. * d/p/Avoid-dependency-on-new-package-mlocati-ip-lib.patch: Improve patch and drop type annotations to restore compatibility with PHP<8 (closes: #1138086). * Refresh d/patches. Checksums-Sha1: 49a5435593fa17063d28734aeadfb72ab0238f67 3860 roundcube_1.6.17+dfsg-0+deb13u= 1.dsc c42a03f7b7f449f7ec9023843d775b66e2887e31 126836 roundcube_1.6.17+dfsg.orig-t= inymce-langs.tar.xz a14b229b6767817fb36d85c6c22b700e81fcc74a 1928888 roundcube_1.6.17+dfsg.orig-= tinymce.tar.xz 1f753251c7e378540cea602af4a7f5db415764fa 2906816 roundcube_1.6.17+dfsg.orig.= tar.xz 17ff58ec398626d36c55feda9620efc00f4871ba 157648 roundcube_1.6.17+dfsg-0+deb1= 3u1.debian.tar.xz 0b149df20a93f3ad1a11319b242b2cf565a59952 6256 roundcube_1.6.17+dfsg-0+deb13u= 1_source.buildinfo Checksums-Sha256: 921dd7ea1f6d00ee1ffdf4c3d490fd5fd2e50351b344ebda9962d29668e49399 3860 roundc= ube_1.6.17+dfsg-0+deb13u1.dsc a9e0dcf588cdfd398b1ffacb63d3cc6cf2132785adcf98b9bc3cb7b23f9f1f6e 126836 roun= dcube_1.6.17+dfsg.orig-tinymce-langs.tar.xz 870c74fc7fe5f66929a8f45b7340be3d542d94ef5786d92393bfbf687c57b1fa 1928888 rou= ndcube_1.6.17+dfsg.orig-tinymce.tar.xz c32cae39892d8936f1b07712e0cda3f435d311cd095e6d949d8e62c473ae1426 2906816 rou= ndcube_1.6.17+dfsg.orig.tar.xz 1c961cee680df5c0a37d474f51663f4bbff85a3fbe67cd60fafb253623f54e5e 157648 roun= dcube_1.6.17+dfsg-0+deb13u1.debian.tar.xz a809dad1f9367a68c04d292ab86caef14fe164f24b976af2c62a6787bbd55e77 6256 roundc= ube_1.6.17+dfsg-0+deb13u1_source.buildinfo Files: 8694c4b8a031452951773cb5c74a1620 3860 web optional roundcube_1.6.17+dfsg-0+d= eb13u1.dsc 14e66bb6839218d4add3e1fbea68952d 126836 web optional roundcube_1.6.17+dfsg.o= rig-tinymce-langs.tar.xz d1198f417f0ae874dedee8a12e7c8713 1928888 web optional roundcube_1.6.17+dfsg.= orig-tinymce.tar.xz dc32d01c80607b6c6ab3a206e354e584 2906816 web optional roundcube_1.6.17+dfsg.= orig.tar.xz eda7bcd661733eff99573717fca5beeb 157648 web optional roundcube_1.6.17+dfsg-0= +deb13u1.debian.tar.xz d1251ffc0525b5bbaac880b1e8fe6601 6256 web optional roundcube_1.6.17+dfsg-0+d= eb13u1_source.buildinfo -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEERpy6p3b9sfzUdbME05pJnDwhpVIFAmpWxVgACgkQ05pJnDwh pVIGRA//bGj8I891f1ENWx0y2oMV+Ef6/Lq8nXUArKAS3TZmfbyBrKRsvBjHECbl rMzXz+rIJ1O9SO3zzR+IJpjjCdfvdkqR+R35X2p3ypZ4eogdVC56Kwvz3I1F6kq0 FWea9pOkN9zwuO8F6Rdwz9hE2Y8fw/oKqEFhU4YS/wKJCkpPFN7jvRlleLyjAO+I oaO/++oSdddjFw5ZyZ340ESkQyvbaReoMQir2NG1TEO5gs6tzCjo1dCFA7Qh2gD8 zYVKcBwnuYl48FDvth+AC9ukDGStAJe+K7XG8me6zWtRpVofjgAsZhuJYnL+Xx6R MM5iewx1s7JdAIZ2MqZn/QGxWFmJDFfjzuo/yYUbiysgXPP6Nnw584JPMJ1iFp4E Kc04tn/lnUBC3dlSHkoiz0IJvlNtJf6UsrFZ7N3aDSG9qc2F45GnLaq+77zbPADr r9EyWfcaLEODWStERAtmOrJkOhFpgH7PpyZAUF3AfnjCjWFZIWKG7zsE9cr9yReg 1nSVHag+Dfel5ntZKQECjQ9qipXUMaZm7OwRqTSo1q2Ce7EKGTsRbEPk56vZcTr0 90WCFKWaJ27nhvjADRJdbnf2abArIuqLP0diR9j+/FvMXEyuTn+w0UqqbQEoGUAq a/QsMM1kmmQne5g7OT3xwpbx+GKwEN8vjjSc9jqUO8X8WhV40C0=3D =3DbJ+5 -----END PGP SIGNATURE----- --===============2962346478964737382== Content-Type: application/pgp-signature -----BEGIN PGP SIGNATURE----- iHUEABYIAB0WIQTziqJOuF8J+ZI8pJSb9qggYcy5IQUCamEQ1gAKCRCb9qggYcy5 IcXBAP0RZMxypA1tWBw2zDQ9zecjbsApWylvUNrWW0P662hJMgD/YNiZgzYvyUAy jSqfCgt4RUcNKlVYb42FhVqMoaLoBgo= =dd5h -----END PGP SIGNATURE----- --===============2962346478964737382==-- ]