[From nobody Thu Oct 29 13:31:07 2026 Received: (at submit) by bugs.debian.org; 19 Oct 2026 14:22:13 +0000 X-Spam-Checker-Version: SpamAssassin 4.0.1-bugs.debian.org_2005_01_02 (2024-03-25) on buxtehude.debian.org X-Spam-Level: X-Spam-Status: No, score=-112.4 required=4.0 tests=ALL_TRUSTED,BAYES_00, DKIMWL_WL_HIGH,DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF, FOURLA,FROMDEVELOPER,MD5_SHA1_SUM,PGPSIGNATURE,SPF_HELO_NONE,SPF_PASS, USER_IN_DKIM_WELCOMELIST,WEBMAIL autolearn=ham autolearn_force=no version=4.0.1-bugs.debian.org_2005_01_02 X-Spam-Bayes: score:0.0000 Tokens: new, 60; hammy, 150; neutral, 149; spammy, 0. spammytokens: hammytokens:0.000-+--Hx-spam-relays-external:sk:stravin, 0.000-+--H*RT:sk:stravin, 0.000-+--Hx-spam-relays-external:311, 0.000-+--H*RT:311, 0.000-+--H*RT:108 Return-path: <guilhem@debian.org> Received: from stravinsky.debian.org ([2001:41b8:202:deb::311:108]:48972) by buxtehude.debian.org with esmtps (TLS1.3:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.96) (envelope-from <guilhem@debian.org>) id 1xIoFh-0006f4-1v for submit@bugs.debian.org; Mon, 19 Oct 2026 14:22:13 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=debian.org; s=smtpauto.stravinsky; h=X-Debian-User:Content-Type:MIME-Version:Message-ID: Subject:To:From:Date:Reply-To:Cc:Content-Transfer-Encoding:Content-ID: Content-Description:In-Reply-To:References; bh=q7frViqpbR8j0TWWda3nN+rfnOst3zKPN9X/HZFGiUo=; b=VP7W8KcpDrl2ejRb62Y9zfx2nv 8VMs3OCF7kWaqZsp6cKERVVwACtVFpaA7q4d388IIvgsgiOnVJCIlyY4U9Nuu4C+Cr0BZKLoFfN/v KDjQnAWaJ8YnnL3T+Abf4VIzckAQ4paJFzaSayIj4sROXpitNPfPN+jfNCr/Z6qIOr7Ykn+zExkCs cbRSgWkGKCQDI1RzQU+GnM4/fBWUQGFKoncyTaoOwAsmogZI9ihC46YEI+DP+aHXYVdtN2QRcXitC VF8/UXPiIkyq9U+2gWRCfV6IvkHDLUAKX3KIGBFjG9UXZ7TtY6kk/mniGA0Oa6CKhp2FpCNppF/b7 5dvJYgJA==; Received: from authenticated-user by stravinsky.debian.org with esmtpsa (TLS1.3:ECDHE_X25519__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.96) (envelope-from <guilhem@debian.org>) id 1xIoFc-00063B-33; Mon, 19 Oct 2026 14:22:09 +0000 Received: by localhost.localdomain (Postfix, from userid 1000) id 4D978421746; Mon, 19 Oct 2026 16:22:07 +0200 (CEST) Date: Mon, 19 Oct 2026 16:22:07 +0200 From: Guilhem Moulin <guilhem@debian.org> To: Debian Bug Tracking System <submit@bugs.debian.org> Subject: roundcube: Multiple security vulnerabilities Message-ID: <atYnjekb7SLlHkaU@debian.org> MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="ll7DVixv3P13oMOm" Content-Disposition: inline X-Reportbug-Version: 13.2.0+nmu1 X-Debian-User: guilhem Delivered-To: submit@bugs.debian.org --ll7DVixv3P13oMOm Content-Type: text/plain; charset=utf-8 Content-Disposition: inline Content-Transfer-Encoding: quoted-printable Source: roundcube Version: 1.6.19+dfsg-1 Control: found -1 1.6.19+dfsg-0+deb13u1 Control: found -1 1.6.5+dfsg-1+deb12u12 Severity: important Tags: security upstream X-Debbugs-Cc: Debian Security Team <team@security.debian.org> Roundcube webmail upstream has just released 1.6.20 [0] which fixes a new batch of security vulnerabilities: * Fix IMAP command injection via CRLF in _uid parameter of mail/headers a= nd mail/viewsource action https://github.com/roundcube/roundcubemail/commit/f62879defc0330ae240c7= 2b83b2d00a8ab337447 * Fix bug where an alias login wasn=E2=80=99t qualified by IMAP host https://github.com/roundcube/roundcubemail/commit/cb235cbfef88cbf78236d= c67d3b667bf3dc61ddd * Add a size limit to the CSS proxy content processing https://github.com/roundcube/roundcubemail/commit/99a5bdd05b01f45493cc0= da4c96968eac7668126 * Fix SSRF filter (is_local_url()) bypass via NAT64 64:ff9b::/96 https://github.com/roundcube/roundcubemail/commit/3c3a65f66b53b7aaf3d72= 0acd06e0b102eceb090 * Fix remote content blocking bypass via SVG SMIL by attribute https://github.com/roundcube/roundcubemail/commit/2b6ff79d8b14f94b0ff04= 765b7f02dbfdfe98efa * Fix remote content blocking bypass via CSS escapes in FuncIRI attribute= s (again) https://github.com/roundcube/roundcubemail/commit/ff4fcfdd2952f9d09947c= c9c18137f381f27caf1 * Fix passing potentally unsafe attachment content into ImageMagick on im= age resize https://github.com/roundcube/roundcubemail/commit/895d88af37720d2b46e45= 53f524013b2e1cb7665 * Fix mail header injection via the From display-name in the Bounce (rese= nd) action https://github.com/roundcube/roundcubemail/commit/3a136465c965776a5f636= 587187626985dae4f3b * Fix mail header injection via References/In-Reply-To/Message-ID/From pa= rameters https://github.com/roundcube/roundcubemail/commit/79adcfc0c48012bbbe930= 278471425027fd7331c * Fix object injection primitive in rcube_session::unserialize() via =E2= =80=9C!=E2=80=9D-prefixed session keys https://github.com/roundcube/roundcubemail/commit/833770d3d3c35cfde74cc= 2614d368f25a75b6f99 * Fix ImageMagick resource limits bypass by GD fallback during thumbnail = generation https://github.com/roundcube/roundcubemail/commit/0bea81121efd96f07432a= 837f391dbdd0dffa33f * Fix CSS scoping bypass in HTML messages using at-rules https://github.com/roundcube/roundcubemail/commit/ff9cf4a9bf3b7c66db9af= e43fe5f1cc73b47ed35 * Fix bug where deprecated action aliases bypassed disabled_actions setti= ng https://github.com/roundcube/roundcubemail/commit/e7c512ae09ebd0ae5d0d2= f29e00a767bf91f6bbe * Fix IMAP command injection via CRLF in _flag parameter of mail/mark act= ion https://github.com/roundcube/roundcubemail/commit/242c6d6a150c850bd96d2= 0d400261e71f8d11f9b * Fix CSRF validation bypass in the mark-as-junk action https://github.com/roundcube/roundcubemail/commit/15b0dc0d6e5712310c8f6= 63577361bf8132a7f81 * Fix XSS issue in handling of password driver error responses https://github.com/roundcube/roundcubemail/commit/94298856ee67ff7817cc4= def2adb634be91e28c7 * Fix mail header injection via subject of a message forwarded as attachm= ent https://github.com/roundcube/roundcubemail/commit/c325953a251d0132f1909= 569b3eac0b974095dd4 * Fix mail header injection via media type in an inline image data URI https://github.com/roundcube/roundcubemail/commit/adb9b9b3fd43e30af1c16= 6b79494726d89f828eb * Fix bug where Password Modoboa driver could change password for another= account https://github.com/roundcube/roundcubemail/commit/3d9d05bfe2da7f93b8d47= e68cadab22bb67e6cc9 * Fix unsafe use of a login name in SquirrelMail import file path https://github.com/roundcube/roundcubemail/commit/15fd175d154311ca7f59c= f696c6cc39471611aa6 AFAIK no CVE-ID have been published for these issues. I'm quite busy this = week and will probably not find time to file MITRE's form before the week-end. --=20 Guilhem. [0] https://roundcube.net/news/2026/10/19/security-updates-1.6.20-and-1.7.5 https://github.com/roundcube/roundcubemail/releases/tag/1.6.20 --ll7DVixv3P13oMOm Content-Type: application/pgp-signature; name=signature.asc -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEERpy6p3b9sfzUdbME05pJnDwhpVIFAmrWJ40ACgkQ05pJnDwh pVJ3Zw//bwdOr7q0vDmf2cirlDWWOgwFHPvB/0Cj7pVtYdoxGvTpyDvSubYRqMAW 6ffFWTXtXRbkFbiXfKXt/NjZGBYJtQo83yJOPECv/nXhKkzRu7kA6Vml4lxTr5ul q2sAJgORmN82t1FFZUR3uQvrHWqNlRo/YLKF0Mu12VO5qUib9ldLPvk5/TX4oXOC BitKrKGxLQpHJw+HMcMYYGpsErpjKUifLNASYy3iz4Wq/sKs/Fo4tUL8kIEZHd27 wQApdTRAbBD989ESHIEc+uZn1crT8AT8Dvtax+759sbG4sxjqmmyWQIxzl7ccCMt kPGn8P779lPKtoYG4sHEz/6qLMa7TeMinIauxzsIDjALjd4KrhjGVWz/yBnwwCbM sB3OrJXlCspTPhAGDpBNwB+9EgICxwymztgoXb9a778E8bGQ9CfSKIauG/+ukCIG 5IzoKsh1re+jmW0qynsG+STMVmFCAcrY8q6QFYgE7g46Hf+xNROhZw7a8uFN6zlu HwHes0auXV+WnBRwwwMX4zYgXHVvfMAg8t+Md229cnT9foTnn2G9kCAKytHe6Idx 8N0NZcT1s1YOBo4rw/svHsgWFcG95AYBu51KpyOzd7fnxYNuyzAe5u3FFuK2nb3K F9wJvDy6Lnfpvh6Ng8z/G1Hs0xwUwTzwUUoiLb7HNOlKG2Rqf0k= =huQe -----END PGP SIGNATURE----- --ll7DVixv3P13oMOm-- ]