[From nobody Mon Aug 10 23:07:11 2026 Received: (at 1144059-close) by bugs.debian.org; 10 Aug 2026 22:05:07 +0000 X-Spam-Checker-Version: SpamAssassin 4.0.1-bugs.debian.org_2005_01_02 (2024-03-25) on buxtehude.debian.org X-Spam-Level: X-Spam-Status: No, score=-112.5 required=4.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,FOURLA,FVGT_m_MULTI_ODD, HAS_BUG_NUMBER,MD5_SHA1_SUM,PDS_BTC_ID,PGPSIGNATURE,RCVD_IN_DNSWL_MED, SPF_HELO_PASS,SPF_PASS,USER_IN_DKIM_WELCOMELIST autolearn=ham autolearn_force=no version=4.0.1-bugs.debian.org_2005_01_02 X-Spam-Bayes: score:0.0000 Tokens: new, 107; hammy, 150; neutral, 229; spammy, 0. spammytokens: hammytokens:0.000-+--HX-Debian:DAK, 0.000-+--H*rp:D*ftp-master.debian.org, 0.000-+--HX-DAK:process-upload, 0.000-+--UD:debian.tar.xz, 0.000-+--H*r:sk:fasolo. Return-path: <envelope@ftp-master.debian.org> Received: from mitropoulos.debian.org ([2001:648:2ffc:deb:216:61ff:fe9d:958d]:46958) by buxtehude.debian.org with esmtps (TLS1.3:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.96) (envelope-from <envelope@ftp-master.debian.org>) id 1wtY7H-008t2u-1e for 1144059-close@bugs.debian.org; Mon, 10 Aug 2026 22:05:07 +0000 Received: via submission from C=NA, ST=NA, L=Ankh Morpork, O=Debian SMTP, OU=Debian SMTP CA, CN=fasolo.debian.org, EMAIL=hostmaster@fasolo.debian.org (verified) by mitropoulos.debian.org with esmtps (TLS1.3:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.96) (envelope-from <envelope@ftp-master.debian.org>) id 1wtY7F-0040RD-2c for 1144059-close@bugs.debian.org; Mon, 10 Aug 2026 22:05:05 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=ftp-master.debian.org; s=smtpauto.fasolo; h=Date:Message-Id:Content-Type: Subject:MIME-Version:To:Reply-To:From:Cc:Content-Transfer-Encoding:Content-ID :Content-Description:In-Reply-To:References; bh=HD8X6gRYgtwGvMxuUhrADhUHKDWqhPTNrMJVv8Kr/wc=; b=O6mXpHRgThsGBT7Gu7vBISmrie mdGyAzWQrO2667THyCNQlmN7zsnrSbUwmOqVw6I90rC1r7sKzqke3Ef3Nq29/H01jlORTtA0PYszt N01iu0r+iGqJho3Z4qrbOZagntsjvOAR2F9fIxkCo7iyHBcFJidd04fP0QP80QI/9tA/8x/btQ34U C2R5JefPYwQ2EYLvtT+WkjU8kk2/NoTyCpNJatMCUoO6iscwaNzwyR2gGeLy+gJkBuKg8DsHFd5a2 H9xdAy9/Wt3w3HOPeEV84Dvf100w0i6/4tdP6GbYlMQ0vRyT2sTldgM+23EXMhRr6qJ21GWYqBNkO uOVHqEZw==; Received: from dak by fasolo.debian.org with local (Exim 4.98.2) (envelope-from <envelope@ftp-master.debian.org>) id 1wtY7E-00000003QBt-2hG0; Mon, 10 Aug 2026 22:05:04 +0000 From: Debian FTP Masters <ftpmaster@ftp-master.debian.org> Reply-To: Guilhem Moulin <guilhem@debian.org> To: 1144059-close@bugs.debian.org X-DAK: dak process-upload X-Debian: DAK X-Debian-Package: roundcube Debian: DAK Debian-Changes: roundcube_1.6.18+dfsg-1_source.changes Debian-Source: roundcube Debian-Version: 1.6.18+dfsg-1 Debian-Architecture: source Debian-Suite: unstable Debian-Archive-Action: accept MIME-Version: 1.0 Subject: Bug#1144059: fixed in roundcube 1.6.18+dfsg-1 Content-Type: multipart/signed; micalg="pgp-sha256"; protocol="application/pgp-signature"; boundary="===============6039434446428761515==" Message-Id: <E1wtY7E-00000003QBt-2hG0@fasolo.debian.org> Date: Mon, 10 Aug 2026 22:05:04 +0000 --===============6039434446428761515== Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Source: roundcube Source-Version: 1.6.18+dfsg-1 Done: Guilhem Moulin <guilhem@debian.org> We believe that the bug you reported is fixed in the latest version of roundcube, which is due to be installed in the Debian FTP archive. A summary of the changes between this version and the previous one is attached. Thank you for reporting the bug, which will now be closed. If you have further comments please address them to 1144059@bugs.debian.org, and the maintainer will reopen the bug report if appropriate. Debian distribution maintenance software pp. Guilhem Moulin <guilhem@debian.org> (supplier of updated roundcube package) (This message was generated automatically at their request; if you believe that there is a problem with it please contact the archive administrators by mailing ftpmaster@ftp-master.debian.org) -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Mon, 10 Aug 2026 15:15:16 +0200 Source: roundcube Architecture: source Version: 1.6.18+dfsg-1 Distribution: unstable Urgency: high Maintainer: Debian Roundcube Maintainers <pkg-roundcube-maintainers@alioth-li= sts.debian.net> Changed-By: Guilhem Moulin <guilhem@debian.org> Closes: 1144059 Changes: roundcube (1.6.18+dfsg-1) unstable; urgency=3Dhigh . * New upstream security and bugfix release (closes: #1144059). + Content proxied by the css proxy is not validated validation. + SSRF bypass via specific local address URLs using 100.64.0.0/10 and fe80::/10 subnets. + SSRF filter bypass via various forms of nip.io/sslip.io hostnames evading `is_local_url()` check. + Remote content blocking bypass via unclosed `url()` in a FuncIRI attribute. + LDAP filter injection via unescaped %u/%fu/%d substitution into the `search_filter`. + Arbitrary sieve script injection via a filter rule name bypassing `managesieve_disabled_actions`. + RCE in the `cmd_learn` driver of markasjunk plugin. + IMAP command injection via mail search and LITERAL+ byte-count desynchronization. + The modoboa driver of the passwd plugin leaks an authentication token to a user-controlled host. + Stored XSS in "Add to address book" action. + HTML/CSS sanitization bypass via SVG animate `by` attribute. * Refresh d/patches. * Cherry-pick follow-up change to fix PHP warning in markasjunk's cmd_learn.php. Checksums-Sha1: 7baebfb91ba8cd774b09a1bd9eba8aa358da1c5e 3845 roundcube_1.6.18+dfsg-1.dsc d1f446017c4ecc7d79a0ea6b465feb3fbee7b9c7 126948 roundcube_1.6.18+dfsg.orig-t= inymce-langs.tar.xz af0bba30402c4c02beaca3ae96ac6aa12a4a6da6 1928640 roundcube_1.6.18+dfsg.orig-= tinymce.tar.xz 2b80f406956df4da1213893520778b94814aacd0 2907948 roundcube_1.6.18+dfsg.orig.= tar.xz 5ac234f7d61dc9868667328b0a4c4617739a8ebb 159932 roundcube_1.6.18+dfsg-1.debi= an.tar.xz 2444dd3097df882acdd772fdca20517a664e9ce8 6267 roundcube_1.6.18+dfsg-1_source= .buildinfo Checksums-Sha256: 23b49565b6327af40aad18bfe286f31846ea242b356a7ab420e3c26eb8959ae3 3845 roundc= ube_1.6.18+dfsg-1.dsc f009f44443e465cd7a06a758cb878402868f61b47762bf247f572fd2b3fd1bfb 126948 roun= dcube_1.6.18+dfsg.orig-tinymce-langs.tar.xz 518547256094a0214580e18b22693cc63d54dd059d8a8116a967898c854a7acb 1928640 rou= ndcube_1.6.18+dfsg.orig-tinymce.tar.xz b413364d67014758eb4a4b87adc2a0f465e0a0bedf23d644d61955280f1df900 2907948 rou= ndcube_1.6.18+dfsg.orig.tar.xz 1c542e61291d3fa88aa4f3012eecd69dbb549291572e2d97d270bf62ea85ce84 159932 roun= dcube_1.6.18+dfsg-1.debian.tar.xz 8f31c303e98a4e46b1cf2528489ad219003b173f9a74fa5bd094de19604eac0c 6267 roundc= ube_1.6.18+dfsg-1_source.buildinfo Files: cc4f51b8b3dd63b2d0dd5af04c67b65d 3845 web optional roundcube_1.6.18+dfsg-1.d= sc 6d1099a82016ca3d45dbba79295f6e30 126948 web optional roundcube_1.6.18+dfsg.o= rig-tinymce-langs.tar.xz 49949888729c8204636bc14cffcfa003 1928640 web optional roundcube_1.6.18+dfsg.= orig-tinymce.tar.xz 8e988bb1541cf388be0bd2630e01dc90 2907948 web optional roundcube_1.6.18+dfsg.= orig.tar.xz 37bae46e8fd6d258d674b855336ceea8 159932 web optional roundcube_1.6.18+dfsg-1= .debian.tar.xz 6c177af0cd190b55038131044b936f6d 6267 web optional roundcube_1.6.18+dfsg-1_s= ource.buildinfo -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEERpy6p3b9sfzUdbME05pJnDwhpVIFAmp6RvgACgkQ05pJnDwh pVK7GQ/8DWHdVZIVwciMppsNtzrrBlT14Hhq4XzHJRrFYPO9gGjl7NfU3kubRBqD C3OqRAznGR5jWJEGNODdKqnE/gG7wd3fp5D5wlljpsCtp4knjuqV0JWqf95WI3f1 qyv4MI8Lo2RDCQ0+zfUd1chnHFj8sX8jJKBYSyUVGA2ZuTUnVBvvLHavzz79lRGY cgp+CSkYMHLDSgUF6YjwtHf40myCWhtIPCj+HoTIc7jLXXT7ugmLeEXB0wN/SRmK wJhxJtBJ4aeiLlwtAsv1aLAelpreyHw+9506wg5hLSXaTZOHAWxTzw4LZkOX1KSV CHwO+3fECnp96ieJR3LH7m9GRizgVCwOKg+N1DQdwTmutOT+NP01YE/Tl5P0LBFv XZRvS5/zFxz1T9SbNGCMJZLIhQb+6i5kl5c+XYHYuHxGLovbLal3rMg+TwyZi2Au wijKc9BGVUVX3NpHrvYywnbIsu6OAFNmsBGIK/Ml1Mx51rxojhCSNo/oHkoTSUtP Wlesnod5vyRT08sOLvC2F1Fo2hCbKbR3fQKzIBHomk+gJ4KSMB9tDvWpYOls8LD+ ObD5racM2b8OcfzpwFHvplzCVOYKbyBxJXSRa5LD/c/v94+2bueG2KOLSLvRmhr4 BovKQKTKzdQEUJnBCl5ytWMPFvYIH+DfBqd2tyPydI7Z3tM7FEs=3D =3DZ2b7 -----END PGP SIGNATURE----- --===============6039434446428761515== Content-Type: application/pgp-signature -----BEGIN PGP SIGNATURE----- iHUEABYIAB0WIQTziqJOuF8J+ZI8pJSb9qggYcy5IQUCanpLEAAKCRCb9qggYcy5 IQPwAQCySDYOg8o7ND+YG5yGD1notBu/QBoc1b/BF19g4PXYawEAqpij5Adjd75G cR+JvV0jmrBQQwLEucMXswIOqHmM7gQ= =0vLJ -----END PGP SIGNATURE----- --===============6039434446428761515==-- ]