[From nobody Sun Oct 11 12:55:12 2026 Received: (at 1146838-close) by bugs.debian.org; 11 Oct 2026 11:52:29 +0000 X-Spam-Checker-Version: SpamAssassin 4.0.1-bugs.debian.org_2005_01_02 (2024-03-25) on buxtehude.debian.org X-Spam-Level: X-Spam-Status: No, score=-114.1 required=4.0 tests=ALL_TRUSTED,BAYES_00, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,FOURLA, FVGT_m_MULTI_ODD,HAS_BUG_NUMBER,MD5_SHA1_SUM,PGPSIGNATURE, USER_IN_DKIM_WELCOMELIST autolearn=ham autolearn_force=no version=4.0.1-bugs.debian.org_2005_01_02 X-Spam-Bayes: score:0.0000 Tokens: new, 84; hammy, 150; neutral, 225; spammy, 0. spammytokens: hammytokens:0.000-+--HX-Debian:DAK, 0.000-+--H*rp:D*ftp-master.debian.org, 0.000-+--UD:debian.tar.xz, 0.000-+--H*r:sk:fasolo., 0.000-+--H*MI:fasolo Return-path: <envelope@ftp-master.debian.org> Received: from muffat.debian.org ([2607:f8f0:614:1::1274:33]:33306) by buxtehude.debian.org with esmtps (TLS1.3:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.96) (envelope-from <envelope@ftp-master.debian.org>) id 1xFs6Q-00AmJo-1M for 1146838-close@bugs.debian.org; Sun, 11 Oct 2026 11:52:29 +0000 Received: via submission from C=NA, ST=NA, L=Ankh Morpork, O=Debian SMTP, OU=Debian SMTP CA, CN=fasolo.debian.org, EMAIL=hostmaster@fasolo.debian.org (verified) by muffat.debian.org with esmtps (TLS1.3:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.96) (envelope-from <envelope@ftp-master.debian.org>) id 1xFs6P-002b7n-2J for 1146838-close@bugs.debian.org; Sun, 11 Oct 2026 11:52:29 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=ftp-master.debian.org; s=smtpauto.fasolo; h=Date:Message-Id:Content-Type: Subject:MIME-Version:To:Reply-To:From:Cc:Content-Transfer-Encoding:Content-ID :Content-Description:In-Reply-To:References; bh=nBWEkelLLvVoatAjHDhQZsttvOb4uIYOykRUIbgflQY=; b=dGKNTNE/YoYy81wlCxLigTzRdC nHFhoBisX7HiGtEB3AJCedv9TJb+ApA3rCMJq1ZF13e9zjLiW+gcbcGlzk96nl8GY83f5Qi9R8Bu+ WVX+U1L5sDOXfa7LtN2LvrGXdryFbNWJ+7fsk92PV4Wjm1mtfjj1InxLGNeA9HH0eV6ah2BJQZgrO 71QdhSBcaWLB62zkcb9f8KzMJ4rmAQeKTOr/THAIumYpeIRkEPMmXn2egXwS3YFyCnXSu/kceYTEM sIlPGGgSdpsoQGRb+wsfgXIpIf25QUtQ5eTPPHTu6VUke7mZloGJgjumW+DYYM8OjsH/WLpKvGK9R JtqimsTg==; Received: from dak by fasolo.debian.org with local (Exim 4.98.2) (envelope-from <envelope@ftp-master.debian.org>) id 1xFs6O-00000007Gqg-3pQp; Sun, 11 Oct 2026 11:52:28 +0000 From: Debian FTP Masters <ftpmaster@ftp-master.debian.org> Reply-To: Guilhem Moulin <guilhem@debian.org> To: 1146838-close@bugs.debian.org X-DAK: dak process-policy X-Debian: DAK X-Debian-Package: roundcube Debian: DAK Debian-Changes: roundcube_1.6.19+dfsg-0+deb13u1_source.changes Debian-Source: roundcube Debian-Version: 1.6.19+dfsg-0+deb13u1 Debian-Architecture: source Debian-Suite: proposed-updates Debian-Archive-Action: accept MIME-Version: 1.0 Subject: Bug#1146838: fixed in roundcube 1.6.19+dfsg-0+deb13u1 Content-Type: multipart/signed; micalg="pgp-sha256"; protocol="application/pgp-signature"; boundary="===============4537375061211576046==" Message-Id: <E1xFs6O-00000007Gqg-3pQp@fasolo.debian.org> Date: Sun, 11 Oct 2026 11:52:28 +0000 --===============4537375061211576046== Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Source: roundcube Source-Version: 1.6.19+dfsg-0+deb13u1 Done: Guilhem Moulin <guilhem@debian.org> We believe that the bug you reported is fixed in the latest version of roundcube, which is due to be installed in the Debian FTP archive. A summary of the changes between this version and the previous one is attached. Thank you for reporting the bug, which will now be closed. If you have further comments please address them to 1146838@bugs.debian.org, and the maintainer will reopen the bug report if appropriate. Debian distribution maintenance software pp. Guilhem Moulin <guilhem@debian.org> (supplier of updated roundcube package) (This message was generated automatically at their request; if you believe that there is a problem with it please contact the archive administrators by mailing ftpmaster@ftp-master.debian.org) -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Sun, 06 Sep 2026 13:22:41 +0200 Source: roundcube Architecture: source Version: 1.6.19+dfsg-0+deb13u1 Distribution: trixie-security Urgency: high Maintainer: Debian Roundcube Maintainers <pkg-roundcube-maintainers@alioth-li= sts.debian.net> Changed-By: Guilhem Moulin <guilhem@debian.org> Closes: 1146838 Changes: roundcube (1.6.19+dfsg-0+deb13u1) trixie-security; urgency=3Dhigh . * New upstream security and bugfix release (closes: #1146838). + Fix CSS declaration smuggling via un-encoded ampersand emission. + Fix CSS property injection via body `background` attribute. + Fix email header injection via bare CR in the subject field. + Fix email header injection via C-escape `\r` in the recipient display name. + Fix email header injection via identity's organization field. + Fix zero-click stored XSS via TNEF MIME tag injection in the attachment URL. + Fix XSS in the HTML editor using text/enriched part content. + Fix cross-user access in contact group membership (add/remove) in the SQL address book. + Fix `is_local_url()` bypass via trailing-dot FQDN in stylesheet URL. + Fix remote content blocking bypass via CSS escapes in FuncIRI attributes. + Fix remote-content blocker bypass via SVG SMIL src animation. * Refresh d/patches and remove those applied upstream. Checksums-Sha1: abf62dd6b4459360ffeebfdb534b34f991e26857 3860 roundcube_1.6.19+dfsg-0+deb13u= 1.dsc 42a4a432e26557e1f256016fd70522a3e5fc7dd8 126884 roundcube_1.6.19+dfsg.orig-t= inymce-langs.tar.xz f181c2ba04cea59621711962e3553c53e9d9882a 1928432 roundcube_1.6.19+dfsg.orig-= tinymce.tar.xz 8c7c229d2ba194dc8dfb1874efb9b1401a786ff1 2910024 roundcube_1.6.19+dfsg.orig.= tar.xz 51af771a0b18501a16527b46ca2e1fc06816fc89 158696 roundcube_1.6.19+dfsg-0+deb1= 3u1.debian.tar.xz e1a03051a51563b0d244aa009a19c4f4168ad7df 6633 roundcube_1.6.19+dfsg-0+deb13u= 1_source.buildinfo Checksums-Sha256: 9e4fc3d1153b54397d74fd0ea4edbe6c3b18ea6f947885ecc004bf85ab5b7e13 3860 roundc= ube_1.6.19+dfsg-0+deb13u1.dsc 83b2d0ee3e4d937f86d1a8db01deed4c18c1d097a964a3134f9c0748c6eb0dfb 126884 roun= dcube_1.6.19+dfsg.orig-tinymce-langs.tar.xz d6a37e1987aa5c3b027f916f18ebbb778c38ee3e0cdf236ee88725ab07cdd6f9 1928432 rou= ndcube_1.6.19+dfsg.orig-tinymce.tar.xz 10e6ffaeae68f5aa3d7c41fe5e5c29ca37df500ced8a2b75a0fae66f190050f1 2910024 rou= ndcube_1.6.19+dfsg.orig.tar.xz a3de3cdfe507885459cfce4932b5b6ff1a213af54119d50ae7bc3219db64d6e5 158696 roun= dcube_1.6.19+dfsg-0+deb13u1.debian.tar.xz 46c42ca65a13c105099d70972a23a7fdc6b282541e2dff82d64c33d6cd6d0d8b 6633 roundc= ube_1.6.19+dfsg-0+deb13u1_source.buildinfo Files: 26adba7d4bf72a3d6ebcb8b118cad0b3 3860 web optional roundcube_1.6.19+dfsg-0+d= eb13u1.dsc 8ac2d1ce8d0f3d2979ad98f17a3a5090 126884 web optional roundcube_1.6.19+dfsg.o= rig-tinymce-langs.tar.xz 92283952d3baebc2b092c1298a7f4c0e 1928432 web optional roundcube_1.6.19+dfsg.= orig-tinymce.tar.xz 5d27f90436ad392e742590cc0918a18f 2910024 web optional roundcube_1.6.19+dfsg.= orig.tar.xz 20e2aac5f25eec65333982ce073acb66 158696 web optional roundcube_1.6.19+dfsg-0= +deb13u1.debian.tar.xz dc22a9f63813ddaafe25d59fc20f8178 6633 web optional roundcube_1.6.19+dfsg-0+d= eb13u1_source.buildinfo -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEERpy6p3b9sfzUdbME05pJnDwhpVIFAmrD94wACgkQ05pJnDwh pVLa9g//VZBBNRaQINXz9/8PFXfjlENS72pmSiAnTotXsHsX/r6gQDV6HuOu+rUE hgHT2V5ZJXe/CaQfLHodSBIjqf2SdDi/7xADyrsnqSc+Qq4V9on25YSj9J6pyRSA PIixw7TE8a+K+SD9RNGTryXdBVOHBdxDLUA5bh1a2R2RcwswxRT4ozpAyKLm7T1Q uhiP7X8gEHafJ9n58yzXS5iI1UrieZb1uhMP7oTpKhgufVgkOnv5o6ppGPMJejtW gzoECHGrZoadtkGCM7+RzzjJccntQgoJ+XVeKeCMc5y41Vxm+7RnDzJy0IYpepp5 whUjUbYcHbNMj7s8t3+BNfMqc6Ukuf0H7IV0iWuJ0aYcWgsKIYKMKQ33u8xInGBw hS1f2G0I2PLslIv00AVZsR0ba4goEH/FsydCxboFU4IfI1PsdhFrBdH/g16OBLx5 5+gMxGxjyyzN1I3BTHvZ4VXrbvlmd/60nflIt/EOPA1nte177guhKtcnHrVkV+6X J2Yf9xH+gzqtfy3wIFlS6IeFTmZBdzgpFQ/8V1mVoOU/wks7XAV1bc6jAFXY5a2s Th9uNYVb+I+me9fEoEDIKoqo3SQYM5h4RmBwzP96LQ5AlFzXVhX0Tyuur2ZbKis9 tJ5H4vz8+b6HlAMvsP8NsDuIhqRrxx0D3yOr1tbTibH1Bug4GdE=3D =3DK6yv -----END PGP SIGNATURE----- --===============4537375061211576046== Content-Type: application/pgp-signature -----BEGIN PGP SIGNATURE----- iHUEABYIAB0WIQTziqJOuF8J+ZI8pJSb9qggYcy5IQUCast4fAAKCRCb9qggYcy5 IX/QAQCvt0Qkl/rQprRoXQQ3A/Inkh/DxoSMB3K21qmgYEuGlAD9GIv1YBI0jOIS q80+mfV7T+ZxgPF1l2x7094B39eQOAw= =xaIG -----END PGP SIGNATURE----- --===============4537375061211576046==-- ]