[From nobody Mon Aug 31 14:49:15 2026 Received: (at 1144059-close) by bugs.debian.org; 31 Aug 2026 13:48:56 +0000 X-Spam-Checker-Version: SpamAssassin 4.0.1-bugs.debian.org_2005_01_02 (2024-03-25) on buxtehude.debian.org X-Spam-Level: X-Spam-Status: No, score=-114.1 required=4.0 tests=ALL_TRUSTED,BAYES_00, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,FOURLA, FVGT_m_MULTI_ODD,HAS_BUG_NUMBER,MD5_SHA1_SUM,PGPSIGNATURE, SPF_HELO_PASS,SPF_PASS,USER_IN_DKIM_WELCOMELIST autolearn=ham autolearn_force=no version=4.0.1-bugs.debian.org_2005_01_02 X-Spam-Bayes: score:0.0000 Tokens: new, 88; hammy, 150; neutral, 299; spammy, 0. spammytokens: hammytokens:0.000-+--HX-Debian:DAK, 0.000-+--H*rp:D*ftp-master.debian.org, 0.000-+--UD:debian.tar.xz, 0.000-+--H*r:sk:fasolo., 0.000-+--H*MI:fasolo Return-path: <envelope@ftp-master.debian.org> Received: from mailly.debian.org ([2001:41b8:202:deb:6564:a62:52c3:4b72]:57078) by buxtehude.debian.org with esmtps (TLS1.3:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.96) (envelope-from <envelope@ftp-master.debian.org>) id 1x12Nc-007Omw-0F for 1144059-close@bugs.debian.org; Mon, 31 Aug 2026 13:48:56 +0000 Received: via submission from C=NA, ST=NA, L=Ankh Morpork, O=Debian SMTP, OU=Debian SMTP CA, CN=fasolo.debian.org, EMAIL=hostmaster@fasolo.debian.org (verified) by mailly.debian.org with esmtps (TLS1.3:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.96) (envelope-from <envelope@ftp-master.debian.org>) id 1x12Na-007uuv-2f for 1144059-close@bugs.debian.org; Mon, 31 Aug 2026 13:48:54 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=ftp-master.debian.org; s=smtpauto.fasolo; h=Date:Message-Id:Content-Type: Subject:MIME-Version:To:Reply-To:From:Cc:Content-Transfer-Encoding:Content-ID :Content-Description:In-Reply-To:References; bh=GSKW0bqiL+BcGjXtLNu2kK2hbx60cJmnaxmEO3SnASk=; b=FeUt/Tlm+E5IU/TU+A9Wm3dJVx y5cjdCMvyQCp+iIKT01tzhUDIGbs3wp4+SFxiOwZ9iBgWCOOHVnMMQxElmZ3yuhfC0tGSdp4D/QKk 3Vb4/2TXCrFa8RviLuBOh4Qz+rRYEWanzMq7+uzE+MMIL5/2jmpmcYWDqUnXUE5dDq0yShu9l/3ip NCPoe5dHnfWiGyJwOs8Un8L5pb+KiC0qHZqaJo/TDJjLeAWSAwhsi2SdQ6pxZDd0Rz2VueXf4TE4V QEgtA/ChxhNVxFvrMpuif2EvZx60FANKj7t7UF7M8cxdtc25MNDuqFU7yRnM325WkEQhTobU9IWb8 EfyVZuLQ==; Received: from dak by fasolo.debian.org with local (Exim 4.98.2) (envelope-from <envelope@ftp-master.debian.org>) id 1x12NZ-000000050XQ-481e; Mon, 31 Aug 2026 13:48:53 +0000 From: Debian FTP Masters <ftpmaster@ftp-master.debian.org> Reply-To: Guilhem Moulin <guilhem@debian.org> To: 1144059-close@bugs.debian.org X-DAK: dak process-policy X-Debian: DAK X-Debian-Package: roundcube Debian: DAK Debian-Changes: roundcube_1.6.18+dfsg-0+deb13u1_source.changes Debian-Source: roundcube Debian-Version: 1.6.18+dfsg-0+deb13u1 Debian-Architecture: source Debian-Suite: proposed-updates Debian-Archive-Action: accept MIME-Version: 1.0 Subject: Bug#1144059: fixed in roundcube 1.6.18+dfsg-0+deb13u1 Content-Type: multipart/signed; micalg="pgp-sha256"; protocol="application/pgp-signature"; boundary="===============6829380579085924380==" Message-Id: <E1x12NZ-000000050XQ-481e@fasolo.debian.org> Date: Mon, 31 Aug 2026 13:48:53 +0000 --===============6829380579085924380== Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Source: roundcube Source-Version: 1.6.18+dfsg-0+deb13u1 Done: Guilhem Moulin <guilhem@debian.org> We believe that the bug you reported is fixed in the latest version of roundcube, which is due to be installed in the Debian FTP archive. A summary of the changes between this version and the previous one is attached. Thank you for reporting the bug, which will now be closed. If you have further comments please address them to 1144059@bugs.debian.org, and the maintainer will reopen the bug report if appropriate. Debian distribution maintenance software pp. Guilhem Moulin <guilhem@debian.org> (supplier of updated roundcube package) (This message was generated automatically at their request; if you believe that there is a problem with it please contact the archive administrators by mailing ftpmaster@ftp-master.debian.org) -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Mon, 10 Aug 2026 15:45:10 +0200 Source: roundcube Architecture: source Version: 1.6.18+dfsg-0+deb13u1 Distribution: trixie-security Urgency: high Maintainer: Debian Roundcube Maintainers <pkg-roundcube-maintainers@alioth-li= sts.debian.net> Changed-By: Guilhem Moulin <guilhem@debian.org> Closes: 1144059 Changes: roundcube (1.6.18+dfsg-0+deb13u1) trixie-security; urgency=3Dhigh . * New upstream security and bugfix release (closes: #1144059). + Fix CVE-2026-74998: Content proxied by the css proxy is not validated validation. + Fix CVE-2026-75006: SSRF bypass via specific local address URLs using 100.64.0.0/10 and fe80::/10 subnets. + Fix CVE-2026-75006: SSRF filter bypass via various forms of nip.io/sslip.io hostnames evading `is_local_url()` check. + Fix CVE-2026-75003: Remote content blocking bypass via unclosed `url()` in a FuncIRI attribute. + Fix CVE-2026-75007: LDAP filter injection via unescaped %u/%fu/%d substitution into the `search_filter`. + Fix CVE-2026-75004: Arbitrary sieve script injection via a filter rule name bypassing `managesieve_disabled_actions`. + Fix CVE-2026-74997: RCE in the `cmd_learn` driver of markasjunk plugin. + Fix CVE-2026-75002: IMAP command injection via mail search and LITERAL+ byte-count desynchronization. + Fix CVE-2026-75010: The modoboa driver of the passwd plugin leaks an authentication token to a user-controlled host. + Fix CVE-2026-74999: Stored XSS in "Add to address book" action. + Fix CVE-2026-75000: HTML/CSS sanitization bypass via SVG animate `by` attribute. * Refresh d/patches. * Cherry-pick follow-up change to fix PHP warning in markasjunk's cmd_learn.php. Checksums-Sha1: 08e65ba30642d917165c92b6dc541f0f79061372 3860 roundcube_1.6.18+dfsg-0+deb13u= 1.dsc d1f446017c4ecc7d79a0ea6b465feb3fbee7b9c7 126948 roundcube_1.6.18+dfsg.orig-t= inymce-langs.tar.xz af0bba30402c4c02beaca3ae96ac6aa12a4a6da6 1928640 roundcube_1.6.18+dfsg.orig-= tinymce.tar.xz 2b80f406956df4da1213893520778b94814aacd0 2907948 roundcube_1.6.18+dfsg.orig.= tar.xz baff8be4efdca960813d738101b458fcc42b1915 158552 roundcube_1.6.18+dfsg-0+deb1= 3u1.debian.tar.xz 9086f022f790a7080109ade691905dd46f973c26 6268 roundcube_1.6.18+dfsg-0+deb13u= 1_source.buildinfo Checksums-Sha256: 79ef25e48f71d319a944019a8de929aec59d79ebcb092b0d3078fbb345bf63fb 3860 roundc= ube_1.6.18+dfsg-0+deb13u1.dsc f009f44443e465cd7a06a758cb878402868f61b47762bf247f572fd2b3fd1bfb 126948 roun= dcube_1.6.18+dfsg.orig-tinymce-langs.tar.xz 518547256094a0214580e18b22693cc63d54dd059d8a8116a967898c854a7acb 1928640 rou= ndcube_1.6.18+dfsg.orig-tinymce.tar.xz b413364d67014758eb4a4b87adc2a0f465e0a0bedf23d644d61955280f1df900 2907948 rou= ndcube_1.6.18+dfsg.orig.tar.xz b7633afa3585660a1822ae35d52769e72171cddd93504b8e5daf52de8ec91647 158552 roun= dcube_1.6.18+dfsg-0+deb13u1.debian.tar.xz 9979329dc63c4fd35fb7a1253156b9126f7aa5f6e975ad234b234638423e64bc 6268 roundc= ube_1.6.18+dfsg-0+deb13u1_source.buildinfo Files: 6295d7a0660cedfb8a2338d47522dcf6 3860 web optional roundcube_1.6.18+dfsg-0+d= eb13u1.dsc 6d1099a82016ca3d45dbba79295f6e30 126948 web optional roundcube_1.6.18+dfsg.o= rig-tinymce-langs.tar.xz 49949888729c8204636bc14cffcfa003 1928640 web optional roundcube_1.6.18+dfsg.= orig-tinymce.tar.xz 8e988bb1541cf388be0bd2630e01dc90 2907948 web optional roundcube_1.6.18+dfsg.= orig.tar.xz ec90317e38388b990bb8d2c72ee987d3 158552 web optional roundcube_1.6.18+dfsg-0= +deb13u1.debian.tar.xz 44e997bc4fadda5f2d94ebb734ecb806 6268 web optional roundcube_1.6.18+dfsg-0+d= eb13u1_source.buildinfo -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEERpy6p3b9sfzUdbME05pJnDwhpVIFAmqTSm4ACgkQ05pJnDwh pVKo8A/+Nyd6r3swZL1AuMynQRbvhNUZBsZBFoV+19rNT/UJCFQIS+jgibz9eM9z XZxfn/Tsysr6PC4iTjz3PKNSdMVatC8bv9vi138USazNabDL8oukSz1mYCyab/zY kiQpku9KoY32CFbGOsF++lqq84QEXdqSg+rt+7PVgauyojyAND4FRAk3Ryo7FIam dlNNJ6n9suLpA5AzIKKJU9s6u3PJrG65+4ij/9wBs3IC2n0o5MH0TURYcHnSmFeV uBwOo6NJDkG9siGtj3p9+njZ1n8ouUzjX2Gfyn8tlT7DOSP6ZcAKUCqXCIir7gTm ouJSnT0Unw2bmcGVrJngFZqgOdoaB//8Lgbf/qpQL9cp3Lh2/KJPBYxfCRx990UP O/HirrLikSm5/CUlcHp3N660TvCXHuI+wPJniy4SDzrpFJ+vDFUyGtW/geCHDklq u4ZS1IW5ghxuv0pPiEq4HvmGFx1obBJmiwFShL/C1VCjhg8wb198DCl2I0N5bQ63 yekaRAVFZ0OioC9AsGvuWa1CyTvDZglKz+u+EgmE86Pim/B1XDhSSTR+YrMAP4PH pOKHmuEaTxMCsFGX9NjGQJTglv25qadcrJjnLxK+52e8OuAwkg9IiZTWPKkB6OWk 5oyFoCwOl3bNExmnn3kqANqMkljlwA+ZxutCHjPDbQ6SsTUTouE=3D =3DYnPQ -----END PGP SIGNATURE----- --===============6829380579085924380== Content-Type: application/pgp-signature -----BEGIN PGP SIGNATURE----- iHUEABYIAB0WIQTziqJOuF8J+ZI8pJSb9qggYcy5IQUCapWGRQAKCRCb9qggYcy5 IYmuAQDs75UPxeWEx1Mah7eJx3CdnW4TMWgU+yVWtd169cERQAEA5ZV6RFBIMPk9 V0kCHLsglelKHj09eHMegagvJC65vw0= =QyAc -----END PGP SIGNATURE----- --===============6829380579085924380==-- ]