[From nobody Mon Oct 19 17:21:06 2026 Received: (at 1151279-close) by bugs.debian.org; 19 Oct 2026 16:19:27 +0000 X-Spam-Checker-Version: SpamAssassin 4.0.1-bugs.debian.org_2005_01_02 (2024-03-25) on buxtehude.debian.org X-Spam-Level: X-Spam-Status: No, score=-114.1 required=4.0 tests=ALL_TRUSTED,BAYES_00, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,FOURLA, FVGT_m_MULTI_ODD,HAS_BUG_NUMBER,MD5_SHA1_SUM,PGPSIGNATURE, SPF_HELO_PASS,SPF_PASS,USER_IN_DKIM_WELCOMELIST autolearn=ham autolearn_force=no version=4.0.1-bugs.debian.org_2005_01_02 X-Spam-Bayes: score:0.0000 Tokens: new, 99; hammy, 150; neutral, 269; spammy, 0. spammytokens: hammytokens:0.000-+--HX-Debian:DAK, 0.000-+--H*rp:D*ftp-master.debian.org, 0.000-+--HX-DAK:process-upload, 0.000-+--UD:debian.tar.xz, 0.000-+--H*r:sk:fasolo. Return-path: <envelope@ftp-master.debian.org> Received: from mailly.debian.org ([2001:41b8:202:deb:6564:a62:52c3:4b72]:53752) by buxtehude.debian.org with esmtps (TLS1.3:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.96) (envelope-from <envelope@ftp-master.debian.org>) id 1xIq5A-000PU6-0G for 1151279-close@bugs.debian.org; Mon, 19 Oct 2026 16:19:27 +0000 Received: via submission from C=NA, ST=NA, L=Ankh Morpork, O=Debian SMTP, OU=Debian SMTP CA, CN=fasolo.debian.org, EMAIL=hostmaster@fasolo.debian.org (verified) by mailly.debian.org with esmtps (TLS1.3:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.96) (envelope-from <envelope@ftp-master.debian.org>) id 1xIq58-000LUb-0Q for 1151279-close@bugs.debian.org; Mon, 19 Oct 2026 16:19:26 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=ftp-master.debian.org; s=smtpauto.fasolo; h=Date:Message-Id:Content-Type: Subject:MIME-Version:To:Reply-To:From:Cc:Content-Transfer-Encoding:Content-ID :Content-Description:In-Reply-To:References; bh=LQzFmmtIkkcOhMLZgkQjx1q+Ffef/+xBKYEBXRjiD+o=; b=snavJwLgJ6Rru+JDWusxZVFw1/ eBiILoAE+t9kAPpSvpSouPq+Uj2AvRWRLJMk4t1AR3nHa4l7PRnXepm2Riz9Gwspre6pyPrqjA3eb BHiLQ+3eTAUuoAk7ovl84gs2ShpDwxq3dtJGC5S7nrW4Ic8DJAIvYOizo+DVolp1HuDdAQzq/gzYr YD6uTZxxZqQ7nDSDOcchElhLAvmQrhfDPjoxkEyYlQHpRxbNo1KKUN/9Os+Ky2BFQkEat7t6nOfnc xw4zN9ujzaLOh2tHJTZZvf6IgOER1eRj4BDE5ukHrm+GNPf4fFbeRZ4INH4omg4Rwp1xcQFbJg9ZG Mi/I4nJA==; Received: from dak by fasolo.debian.org with local (Exim 4.98.2) (envelope-from <envelope@ftp-master.debian.org>) id 1xIq57-0000000378I-1628; Mon, 19 Oct 2026 16:19:25 +0000 From: Debian FTP Masters <ftpmaster@ftp-master.debian.org> Reply-To: Guilhem Moulin <guilhem@debian.org> To: 1151279-close@bugs.debian.org X-DAK: dak process-upload X-Debian: DAK X-Debian-Package: roundcube Debian: DAK Debian-Changes: roundcube_1.6.20+dfsg-1_source.changes Debian-Source: roundcube Debian-Version: 1.6.20+dfsg-1 Debian-Architecture: source Debian-Suite: unstable Debian-Archive-Action: accept MIME-Version: 1.0 Subject: Bug#1151279: fixed in roundcube 1.6.20+dfsg-1 Content-Type: multipart/signed; micalg="pgp-sha256"; protocol="application/pgp-signature"; boundary="===============1024390093726444389==" Message-Id: <E1xIq57-0000000378I-1628@fasolo.debian.org> Date: Mon, 19 Oct 2026 16:19:25 +0000 --===============1024390093726444389== Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Source: roundcube Source-Version: 1.6.20+dfsg-1 Done: Guilhem Moulin <guilhem@debian.org> We believe that the bug you reported is fixed in the latest version of roundcube, which is due to be installed in the Debian FTP archive. A summary of the changes between this version and the previous one is attached. Thank you for reporting the bug, which will now be closed. If you have further comments please address them to 1151279@bugs.debian.org, and the maintainer will reopen the bug report if appropriate. Debian distribution maintenance software pp. Guilhem Moulin <guilhem@debian.org> (supplier of updated roundcube package) (This message was generated automatically at their request; if you believe that there is a problem with it please contact the archive administrators by mailing ftpmaster@ftp-master.debian.org) -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Mon, 19 Oct 2026 16:51:01 +0200 Source: roundcube Architecture: source Version: 1.6.20+dfsg-1 Distribution: unstable Urgency: medium Maintainer: Debian Roundcube Maintainers <pkg-roundcube-maintainers@alioth-li= sts.debian.net> Changed-By: Guilhem Moulin <guilhem@debian.org> Closes: 1151279 Changes: roundcube (1.6.20+dfsg-1) unstable; urgency=3Dmedium . * New upstream security and bugfix release (closes: #1151279). + Fix IMAP command injection via CRLF in `_uid` parameter of mail/headers and mail/viewsource action. + Fix bug where an alias login wasn't qualified by IMAP host. + Add a size limit to the CSS proxy content processing. + Fix SSRF filter (is_local_url()) bypass via NAT64 64:ff9b::/96. + Fix remote content blocking bypass via SVG SMIL `by` attribute. + Fix remote content blocking bypass via CSS escapes in FuncIRI attribut= es (again). + Fix passing potentially unsafe attachment content into ImageMagick on image resize. + Fix mail header injection via the From display-name in the Bounce (res= end) action. + Fix mail header injection via References/In-Reply-To/Message-ID/From parameters. + Fix object injection primitive in rcube_session::unserialize() via =E2=80=9C!=E2=80=9D-prefixed session keys. + Fix ImageMagick resource limits bypass by GD fallback during thumbnail generation. + Fix CSS scoping bypass in HTML messages using at-rules. + Fix bug where deprecated action aliases bypassed `disabled_actions` setting. + Fix IMAP command injection via CRLF in `_flag` parameter of mail/mark action. + Fix CSRF validation bypass in the mark-as-junk action. + Fix XSS issue in handling of password driver error responses. + Fix mail header injection via subject of a message forwarded as attachment. + Fix mail header injection via media type in an inline image data URI. + Fix bug where Password Modoboa driver could change password for another account. + Fix unsafe use of a login name in SquirrelMail import file path. * Remove `Depends: ${misc:Depends}` from the binary packages. * Refresh d/roundcube-core.lintian-overrides. Checksums-Sha1: 15788fa9018782f7800dd4e7c280a22f82d2f4cf 3845 roundcube_1.6.20+dfsg-1.dsc 32a740c50ee6ae83c79d675e539d9bb4ff86ca19 126856 roundcube_1.6.20+dfsg.orig-t= inymce-langs.tar.xz c17351cead238baa4a63bce2b136ff054c2034f9 1928744 roundcube_1.6.20+dfsg.orig-= tinymce.tar.xz d6cb3e64e6cef16458b627130240c0e7e88b7536 2921204 roundcube_1.6.20+dfsg.orig.= tar.xz 12748f310f554dda71c7ff9eb85ee3c8fd57c223 160736 roundcube_1.6.20+dfsg-1.debi= an.tar.xz d5074c57b5ce2b37285b8d638a43fac0b0679d71 6606 roundcube_1.6.20+dfsg-1_source= .buildinfo Checksums-Sha256: ad49d6e2c5b2456fd1181965d6e2d95b791550fb1fd49f5a8594c5b7db0f0286 3845 roundc= ube_1.6.20+dfsg-1.dsc b7968a5dd8a32fdbde4afd733111a6fd44cbfa346332bd07e4dcf2c5b09007cf 126856 roun= dcube_1.6.20+dfsg.orig-tinymce-langs.tar.xz 5f0d2f90355cd16d94d6be3e857995be0c4bad6b96cde894815901577eba5c34 1928744 rou= ndcube_1.6.20+dfsg.orig-tinymce.tar.xz fa1b308c9e3169776321b80af6f1831329b1947a515a024fe9032e31055c3b39 2921204 rou= ndcube_1.6.20+dfsg.orig.tar.xz 67eb7e731cd90162e0c4e094c6479ffc58c78b3482452c50e7ed194a5e957b7f 160736 roun= dcube_1.6.20+dfsg-1.debian.tar.xz 9983c4c0dceb08ac00793e7647c0260c2d85681693ad48f776404b6bde523e44 6606 roundc= ube_1.6.20+dfsg-1_source.buildinfo Files: 2b50841dc93f7b8d5f4e129b8816c61c 3845 web optional roundcube_1.6.20+dfsg-1.d= sc 9f448ec4c449b2c7a9af1544112ef559 126856 web optional roundcube_1.6.20+dfsg.o= rig-tinymce-langs.tar.xz c7276aef6d00b70deda0abf66bc2e050 1928744 web optional roundcube_1.6.20+dfsg.= orig-tinymce.tar.xz a7ab89080eb8e14bc5433bbd30b05120 2921204 web optional roundcube_1.6.20+dfsg.= orig.tar.xz 4b02718efe18e2ffffbe2193f630da79 160736 web optional roundcube_1.6.20+dfsg-1= .debian.tar.xz c94235c8487a69860e3762d710f6a96e 6606 web optional roundcube_1.6.20+dfsg-1_s= ource.buildinfo -----BEGIN PGP SIGNATURE----- iQIyBAEBCgAdFiEERpy6p3b9sfzUdbME05pJnDwhpVIFAmrWPoEACgkQ05pJnDwh pVI7Ug/4zojdCk8ECAJ0ebvX7Rq6bCzGvUF/05TZnw+VlFnTrDnB1lUrR4eK8SPG Fn+6Vg8DzyqFdl5wsb4QGCdjGhzKdOOGW9QifKa2lbkN6fGbYIM4Q8CEDMr3jn1g aUbYzl94LA1MBdpr+SZrq1U8TpnR2r9NHvP7OckqRR8gN7SjdS37PiH36+8DsC5I 58YQm4jgH1NekIBRlFbysicyuHJMqe3KbEI1rZQ+s2QS0fDFyokfond9PGj1CP9e J7pH5/0yU2OJS0Yw1GErqbt7Z1rW4hNXCujmSORT2UYQ2sAuKX3SdKbvvUQMPZZN l68u9T06OjDxEZQVVRucRQkUDROp4t98vA6r+uVnHlfOV4L0NwpKyIYdhc5i64j4 Ph8Z7ViDgn022QbZNfaX9sWEUO7du/lPU03eFBjYKXU74UdDEvlZp5HE280W/uJd lUaWveT1dpMRo4SiLRDbelVSfvbzeguc2el7UKMpIj7H/vk2txyMY5AKz/FboQEE E5YxkUJ+ncuc4qPzQsgenYbbcpUjXG3O+a3/PbRJn99gKrxIiGY9T4r+KRdxBbAd L7zvBcaEDIzWlwPlwlYbtHreMizCd2glmivDQPtAIOXblUoq3m1frpS0Gm+Tubwm bgTalwF5Zfh9ktQxGpc/5WTxcd4wITSGkpwxHkZq0oPmgvo8/A=3D=3D =3DeGBZ -----END PGP SIGNATURE----- --===============1024390093726444389== Content-Type: application/pgp-signature -----BEGIN PGP SIGNATURE----- iHUEABYIAB0WIQTziqJOuF8J+ZI8pJSb9qggYcy5IQUCatZDDQAKCRCb9qggYcy5 IceTAQCo7iPIka/oDA+Q373RA5YJ51eipcKlXaFEDEPnVWVYLgD/X2T3zvokZ7Gu jvxtSaZACykISsk3rsB+dtPcma90awE= =T4CR -----END PGP SIGNATURE----- --===============1024390093726444389==-- ]