[From nobody Sun Sep 6 16:07:07 2026 Received: (at 1146838-close) by bugs.debian.org; 6 Sep 2026 15:06:15 +0000 X-Spam-Checker-Version: SpamAssassin 4.0.1-bugs.debian.org_2005_01_02 (2024-03-25) on buxtehude.debian.org X-Spam-Level: X-Spam-Status: No, score=-114.1 required=4.0 tests=ALL_TRUSTED,BAYES_00, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,FOURLA, FVGT_m_MULTI_ODD,HAS_BUG_NUMBER,MD5_SHA1_SUM,PGPSIGNATURE, USER_IN_DKIM_WELCOMELIST autolearn=ham autolearn_force=no version=4.0.1-bugs.debian.org_2005_01_02 X-Spam-Bayes: score:0.0000 Tokens: new, 93; hammy, 150; neutral, 210; spammy, 0. spammytokens: hammytokens:0.000-+--HX-Debian:DAK, 0.000-+--H*rp:D*ftp-master.debian.org, 0.000-+--HX-DAK:process-upload, 0.000-+--UD:debian.tar.xz, 0.000-+--H*r:sk:fasolo. Return-path: <envelope@ftp-master.debian.org> Received: from muffat.debian.org ([2607:f8f0:614:1::1274:33]:59050) by buxtehude.debian.org with esmtps (TLS1.3:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.96) (envelope-from <envelope@ftp-master.debian.org>) id 1x3ERj-003Qe3-2Q for 1146838-close@bugs.debian.org; Sun, 06 Sep 2026 15:06:15 +0000 Received: via submission from C=NA, ST=NA, L=Ankh Morpork, O=Debian SMTP, OU=Debian SMTP CA, CN=fasolo.debian.org, EMAIL=hostmaster@fasolo.debian.org (verified) by muffat.debian.org with esmtps (TLS1.3:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.96) (envelope-from <envelope@ftp-master.debian.org>) id 1x3ERk-0014hI-2I for 1146838-close@bugs.debian.org; Sun, 06 Sep 2026 15:06:15 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=ftp-master.debian.org; s=smtpauto.fasolo; h=Date:Message-Id:Content-Type: Subject:MIME-Version:To:Reply-To:From:Cc:Content-Transfer-Encoding:Content-ID :Content-Description:In-Reply-To:References; bh=8rJe2WBrTB3G7Iq8TbVqpH2DWTp5Qj1BUqC1kEVjw+4=; b=BiJq2vfkzZObpMkx1yUJAFb7tD +cok+0o007apCGki609x7MH8H5+AcTGdq97oHXhXjHcw7UGziBGaYgQYLOJRYmx5mNOL5AivE98Fa zWjFv/nHIMCdwzgsGmtyy22LDCXuKPmxua6yEdVxbf3wWkwxiJtGXK7tCJLH4nRj81FMnNyzgwKUj Wqod8JWC8v2Mjqr4ats1sdT5Uggdly6l6tglvLvkVEoefnaapLMNhGpFVxWRESt6UXeWsuprmLzS7 kZJIUPoRt8s4jj2fHdh66H6Z8M4bapQZxOqOpQm3Qh5QyuqYmSJtt5iw9mfJ5zRXdhvrDY19EojQi E620SVxA==; Received: from dak by fasolo.debian.org with local (Exim 4.98.2) (envelope-from <envelope@ftp-master.debian.org>) id 1x3ERi-0000000DxAb-1v7B; Sun, 06 Sep 2026 15:06:14 +0000 From: Debian FTP Masters <ftpmaster@ftp-master.debian.org> Reply-To: Guilhem Moulin <guilhem@debian.org> To: 1146838-close@bugs.debian.org X-DAK: dak process-upload X-Debian: DAK X-Debian-Package: roundcube Debian: DAK Debian-Changes: roundcube_1.6.19+dfsg-1_source.changes Debian-Source: roundcube Debian-Version: 1.6.19+dfsg-1 Debian-Architecture: source Debian-Suite: unstable Debian-Archive-Action: accept MIME-Version: 1.0 Subject: Bug#1146838: fixed in roundcube 1.6.19+dfsg-1 Content-Type: multipart/signed; micalg="pgp-sha256"; protocol="application/pgp-signature"; boundary="===============8135992732840900464==" Message-Id: <E1x3ERi-0000000DxAb-1v7B@fasolo.debian.org> Date: Sun, 06 Sep 2026 15:06:14 +0000 --===============8135992732840900464== Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Source: roundcube Source-Version: 1.6.19+dfsg-1 Done: Guilhem Moulin <guilhem@debian.org> We believe that the bug you reported is fixed in the latest version of roundcube, which is due to be installed in the Debian FTP archive. A summary of the changes between this version and the previous one is attached. Thank you for reporting the bug, which will now be closed. If you have further comments please address them to 1146838@bugs.debian.org, and the maintainer will reopen the bug report if appropriate. Debian distribution maintenance software pp. Guilhem Moulin <guilhem@debian.org> (supplier of updated roundcube package) (This message was generated automatically at their request; if you believe that there is a problem with it please contact the archive administrators by mailing ftpmaster@ftp-master.debian.org) -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Sun, 06 Sep 2026 11:50:58 +0200 Source: roundcube Architecture: source Version: 1.6.19+dfsg-1 Distribution: unstable Urgency: medium Maintainer: Debian Roundcube Maintainers <pkg-roundcube-maintainers@alioth-li= sts.debian.net> Changed-By: Guilhem Moulin <guilhem@debian.org> Closes: 1146838 Changes: roundcube (1.6.19+dfsg-1) unstable; urgency=3Dmedium . * New upstream security and bugfix release (closes: #1146838). + Fix CSS declaration smuggling via un-encoded ampersand emission. + Fix CSS property injection via body `background` attribute. + Fix email header injection via bare CR in the subject field. + Fix email header injection via C-escape `\r` in the recipient display name. + Fix email header injection via identity's organization field. + Fix zero-click stored XSS via TNEF MIME tag injection in the attachment URL. + Fix XSS in the HTML editor using text/enriched part content. + Fix cross-user access in contact group membership (add/remove) in the SQL address book. + Fix `is_local_url()` bypass via trailing-dot FQDN in stylesheet URL. + Fix remote content blocking bypass via CSS escapes in FuncIRI attributes. + Fix remote-content blocker bypass via SVG SMIL src animation. * Refresh d/patches and remove those applied upstream. * Bump debhelper compatibility level to 14 (no changes necessary). Checksums-Sha1: 464ea642b1482891a047cb17bf7ad34bc0a8f65e 3845 roundcube_1.6.19+dfsg-1.dsc 42a4a432e26557e1f256016fd70522a3e5fc7dd8 126884 roundcube_1.6.19+dfsg.orig-t= inymce-langs.tar.xz f181c2ba04cea59621711962e3553c53e9d9882a 1928432 roundcube_1.6.19+dfsg.orig-= tinymce.tar.xz 8c7c229d2ba194dc8dfb1874efb9b1401a786ff1 2910024 roundcube_1.6.19+dfsg.orig.= tar.xz 13d4f75ad1ed1be248c372759322d1acb44129fb 160184 roundcube_1.6.19+dfsg-1.debi= an.tar.xz 4589269843b69e0358f7e4d288a3af88104677a5 6646 roundcube_1.6.19+dfsg-1_source= .buildinfo Checksums-Sha256: 74d6d446c376cc65a1dd2568b0c10a0b4c29a067de5e6d44fff3d7212027ad19 3845 roundc= ube_1.6.19+dfsg-1.dsc 83b2d0ee3e4d937f86d1a8db01deed4c18c1d097a964a3134f9c0748c6eb0dfb 126884 roun= dcube_1.6.19+dfsg.orig-tinymce-langs.tar.xz d6a37e1987aa5c3b027f916f18ebbb778c38ee3e0cdf236ee88725ab07cdd6f9 1928432 rou= ndcube_1.6.19+dfsg.orig-tinymce.tar.xz 10e6ffaeae68f5aa3d7c41fe5e5c29ca37df500ced8a2b75a0fae66f190050f1 2910024 rou= ndcube_1.6.19+dfsg.orig.tar.xz dff5dc5c08ffb9539ce790f88523aefc37e2633b29479f19bc4e2ba879bcd71c 160184 roun= dcube_1.6.19+dfsg-1.debian.tar.xz 2be1fb55aa99c12b8aaaa7901caaeea0aa46a8f72419f040d48c23c180309c08 6646 roundc= ube_1.6.19+dfsg-1_source.buildinfo Files: e8a71b2daab60f2093d8500cc2a8dd4c 3845 web optional roundcube_1.6.19+dfsg-1.d= sc 8ac2d1ce8d0f3d2979ad98f17a3a5090 126884 web optional roundcube_1.6.19+dfsg.o= rig-tinymce-langs.tar.xz 92283952d3baebc2b092c1298a7f4c0e 1928432 web optional roundcube_1.6.19+dfsg.= orig-tinymce.tar.xz 5d27f90436ad392e742590cc0918a18f 2910024 web optional roundcube_1.6.19+dfsg.= orig.tar.xz 95be6ab5708eb4063762df025f170946 160184 web optional roundcube_1.6.19+dfsg-1= .debian.tar.xz f6fe37aeb331940fd911fd7282815968 6646 web optional roundcube_1.6.19+dfsg-1_s= ource.buildinfo -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEERpy6p3b9sfzUdbME05pJnDwhpVIFAmqdfiEACgkQ05pJnDwh pVIXJA/+OEefeNc1YypThImPpB9OZ7JBqSTOEC9qTZz8Le+ZjzUGFcJcWbls2/NO vjAiAq8YCJH7ntbChka6IkEyiiRho2o8e6YTsjdw2TmFKhRrv+65i9Ja9MxoiXua 33uxpdJjSq2+4MlpY+rTuZ8iND8HQk3QtpeAD+7kdyRpmO4Y97gHB/Osovg0YGls TSgKpVvr7REpgcBWaee0tcehMGWuM4x7uKmaQTMiC5qdUgntylsbG+XBQRPXOy4o Kt49JdfD7HSM1Us3F74+rPnsWrAlAl5gIOh2VcW2Kqc3iz4HCCJfOpnoNj52Zffg WZzQxdtW1EP5nH4qk8k4Q94K6e7OVVjc/IdZvJQnfWp2sTD0FqdAfb+BiF5msAK9 agtYJNWfAtWSaJQ99+YByFIeYAWkJjmqKQGirzFMAm11RSotEvKLWPyHSMTCbAmw ThzmqMG9HcaDsTNymAxeKil35oS9SRJs5pOeN0cJKTqPvyLnAaVSiOiUQhDvGbS3 SGBsmxyqdESROFqehdPqFEWQPCGDiMlazw5GCVYUhI2zjTKpyfoJcQl4cpsY+gSX ccAImUKzrge0KByJKPVZsSl57U8xs+rzQt3sETmZnK0PSPMW24bB6MvJjSXpulOZ BPobTNP27sxpSc0p1I0YkKO+kED73kqlZb6yE1VNSMlWbSf1e0E=3D =3DNMMt -----END PGP SIGNATURE----- --===============8135992732840900464== Content-Type: application/pgp-signature -----BEGIN PGP SIGNATURE----- iHUEABYIAB0WIQTziqJOuF8J+ZI8pJSb9qggYcy5IQUCap2BZgAKCRCb9qggYcy5 IW+oAP0d1qWK4x9zWkzWbtmPZ+RRVwbAqjr45UCzItBDpE9sTwD/aptp2WKehECe JT/otEusym2102sfHzu33yCtyI/btQw= =hQJp -----END PGP SIGNATURE----- --===============8135992732840900464==-- ]