[From nobody Thu Oct 29 13:31:07 2026 Received: (at 1151279-close) by bugs.debian.org; 29 Oct 2026 13:30:04 +0000 X-Spam-Checker-Version: SpamAssassin 4.0.1-bugs.debian.org_2005_01_02 (2024-03-25) on buxtehude.debian.org X-Spam-Level: X-Spam-Status: No, score=-112.6 required=4.0 tests=ALL_TRUSTED,BAYES_00, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,FOURLA, FVGT_m_MULTI_ODD,HAS_BUG_NUMBER,MD5_SHA1_SUM,MONEY,PGPSIGNATURE, SPF_HELO_PASS,SPF_PASS,STOCKLIKE,USER_IN_DKIM_WELCOMELIST autolearn=ham autolearn_force=no version=4.0.1-bugs.debian.org_2005_01_02 X-Spam-Bayes: score:0.0000 Tokens: new, 86; hammy, 150; neutral, 287; spammy, 0. spammytokens: hammytokens:0.000-+--HX-Debian:DAK, 0.000-+--H*rp:D*ftp-master.debian.org, 0.000-+--UD:debian.tar.xz, 0.000-+--H*r:sk:fasolo., 0.000-+--H*MI:fasolo Return-path: <envelope@ftp-master.debian.org> Received: from mailly.debian.org ([2001:41b8:202:deb:6564:a62:52c3:4b72]:42010) by buxtehude.debian.org with esmtps (TLS1.3:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.96) (envelope-from <envelope@ftp-master.debian.org>) id 1xMQCj-000wGj-0N for 1151279-close@bugs.debian.org; Thu, 29 Oct 2026 13:30:04 +0000 Received: via submission from C=NA, ST=NA, L=Ankh Morpork, O=Debian SMTP, OU=Debian SMTP CA, CN=fasolo.debian.org, EMAIL=hostmaster@fasolo.debian.org (verified) by mailly.debian.org with esmtps (TLS1.3:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.96) (envelope-from <envelope@ftp-master.debian.org>) id 1xMQCg-004GpV-2l for 1151279-close@bugs.debian.org; Thu, 29 Oct 2026 13:30:02 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=ftp-master.debian.org; s=smtpauto.fasolo; h=Date:Message-Id:Content-Type: Subject:MIME-Version:To:Reply-To:From:Cc:Content-Transfer-Encoding:Content-ID :Content-Description:In-Reply-To:References; bh=M4NTKvdi57DZcwGFQJZ2xeIiSh3P9oAk1wQ/cKIxE5E=; b=TlTdnnWGhc0k1WqOqV4/1/LwYh fcW1Dy3uQeMKZJ0hd+CEoKhGvmawYnmCrfIGOj1zulHLHVSHzSjAHYE8kdl0tbuStJG1/v5KHkt4h O2ut4R2utEfHcQsH4DdFtG4aOyj3txfQm+3goK2Z/AVU2ftfQ8rqxdoDNRrF3bGai+a+hfKlhYyr+ ZpHAatr+hsoTe3CfW92EvgH3Z+9Erg/NMZcR/gB2BY6EZY3Lzb6jbohk/U7fqhwnmP+dk43yrBTxH c09gWmV0+2JzHwhtdt6K/AdQWhDe3Orl3/Hp6Ox9BaOP16haDYVj5jHV6v7ozmvxNjPF9ZbemuS+d 3AIaTcuQ==; Received: from dak by fasolo.debian.org with local (Exim 4.98.2) (envelope-from <envelope@ftp-master.debian.org>) id 1xMQCg-0000000AAci-0CMb; Thu, 29 Oct 2026 13:30:02 +0000 From: Debian FTP Masters <ftpmaster@ftp-master.debian.org> Reply-To: Guilhem Moulin <guilhem@debian.org> To: 1151279-close@bugs.debian.org X-DAK: dak process-policy X-Debian: DAK X-Debian-Package: roundcube Debian: DAK Debian-Changes: roundcube_1.6.20+dfsg-0+deb13u1_source.changes Debian-Source: roundcube Debian-Version: 1.6.20+dfsg-0+deb13u1 Debian-Architecture: source Debian-Suite: proposed-updates Debian-Archive-Action: accept MIME-Version: 1.0 Subject: Bug#1151279: fixed in roundcube 1.6.20+dfsg-0+deb13u1 Content-Type: multipart/signed; micalg="pgp-sha256"; protocol="application/pgp-signature"; boundary="===============1631789297831297143==" Message-Id: <E1xMQCg-0000000AAci-0CMb@fasolo.debian.org> Date: Thu, 29 Oct 2026 13:30:02 +0000 --===============1631789297831297143== Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Source: roundcube Source-Version: 1.6.20+dfsg-0+deb13u1 Done: Guilhem Moulin <guilhem@debian.org> We believe that the bug you reported is fixed in the latest version of roundcube, which is due to be installed in the Debian FTP archive. A summary of the changes between this version and the previous one is attached. Thank you for reporting the bug, which will now be closed. If you have further comments please address them to 1151279@bugs.debian.org, and the maintainer will reopen the bug report if appropriate. Debian distribution maintenance software pp. Guilhem Moulin <guilhem@debian.org> (supplier of updated roundcube package) (This message was generated automatically at their request; if you believe that there is a problem with it please contact the archive administrators by mailing ftpmaster@ftp-master.debian.org) -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Tue, 20 Oct 2026 07:00:29 +0200 Source: roundcube Architecture: source Version: 1.6.20+dfsg-0+deb13u1 Distribution: trixie-security Urgency: high Maintainer: Debian Roundcube Maintainers <pkg-roundcube-maintainers@alioth-li= sts.debian.net> Changed-By: Guilhem Moulin <guilhem@debian.org> Closes: 1151279 Changes: roundcube (1.6.20+dfsg-0+deb13u1) trixie-security; urgency=3Dhigh . * New upstream security and bugfix release (closes: #1151279). + Fix CVE-2026-113386: IMAP command injection via CRLF in `_uid` paramet= er of mail/headers and mail/viewsource action. + Fix bug where an alias login wasn't qualified by IMAP host. + Add a size limit to the CSS proxy content processing. + Fix SSRF filter (`is_local_url()`) bypass via NAT64 64:ff9b::/96. + Fix remote content blocking bypass via SVG SMIL `by` attribute. + Fix remote content blocking bypass via CSS escapes in FuncIRI attribut= es (again). + Fix passing potentially unsafe attachment content into ImageMagick on image resize. + Fix mail header injection via the From display-name in the Bounce (res= end) action. + Fix mail header injection via References/In-Reply-To/Message-ID/From parameters. + Fix object injection primitive in rcube_session::unserialize() via =E2=80=9C!=E2=80=9D-prefixed session keys. + Fix ImageMagick resource limits bypass by GD fallback during thumbnail generation. + Fix CSS scoping bypass in HTML messages using at-rules. + Fix bug where deprecated action aliases bypassed `disabled_actions` setting. + Fix IMAP command injection via CRLF in `_flag` parameter of mail/mark action. + Fix CSRF validation bypass in the mark-as-junk action. + Fix XSS issue in handling of password driver error responses. + Fix mail header injection via subject of a message forwarded as attachment. + Fix mail header injection via media type in an inline image data URI. + Fix bug where Password Modoboa driver could change password for another account. + Fix unsafe use of a login name in SquirrelMail import file path. * Refresh d/patches. Checksums-Sha1: a0a03bd91aa0a453fce1b0fe81640b2e3e991ee0 3860 roundcube_1.6.20+dfsg-0+deb13u= 1.dsc 32a740c50ee6ae83c79d675e539d9bb4ff86ca19 126856 roundcube_1.6.20+dfsg.orig-t= inymce-langs.tar.xz c17351cead238baa4a63bce2b136ff054c2034f9 1928744 roundcube_1.6.20+dfsg.orig-= tinymce.tar.xz d6cb3e64e6cef16458b627130240c0e7e88b7536 2921204 roundcube_1.6.20+dfsg.orig.= tar.xz edd75d5f492f832d17bc7651d442b81b18b7c0e4 159268 roundcube_1.6.20+dfsg-0+deb1= 3u1.debian.tar.xz 3e6098a85573a04218818f1003cc7dcc40fb39ac 6734 roundcube_1.6.20+dfsg-0+deb13u= 1_source.buildinfo Checksums-Sha256: 9e5652f65efed5c66c87c929b71c4e423866e49dcee0ed69a9810b669b020fa1 3860 roundc= ube_1.6.20+dfsg-0+deb13u1.dsc b7968a5dd8a32fdbde4afd733111a6fd44cbfa346332bd07e4dcf2c5b09007cf 126856 roun= dcube_1.6.20+dfsg.orig-tinymce-langs.tar.xz 5f0d2f90355cd16d94d6be3e857995be0c4bad6b96cde894815901577eba5c34 1928744 rou= ndcube_1.6.20+dfsg.orig-tinymce.tar.xz fa1b308c9e3169776321b80af6f1831329b1947a515a024fe9032e31055c3b39 2921204 rou= ndcube_1.6.20+dfsg.orig.tar.xz ebcd742800aff6baed866d2fd2b71a7b078e92b0ab0d9ea260df3bdef0e6dd18 159268 roun= dcube_1.6.20+dfsg-0+deb13u1.debian.tar.xz e753bd947e230d50d76f7d805381f88db5d4ac2dae1e21084d90787cc33dbf3e 6734 roundc= ube_1.6.20+dfsg-0+deb13u1_source.buildinfo Files: 133edf32ba197c0740e7581a99b8c77c 3860 web optional roundcube_1.6.20+dfsg-0+d= eb13u1.dsc 9f448ec4c449b2c7a9af1544112ef559 126856 web optional roundcube_1.6.20+dfsg.o= rig-tinymce-langs.tar.xz c7276aef6d00b70deda0abf66bc2e050 1928744 web optional roundcube_1.6.20+dfsg.= orig-tinymce.tar.xz a7ab89080eb8e14bc5433bbd30b05120 2921204 web optional roundcube_1.6.20+dfsg.= orig.tar.xz 6f9acb638292ccedde2dfbf78a7caa2c 159268 web optional roundcube_1.6.20+dfsg-0= +deb13u1.debian.tar.xz 7dbfcd846cd83138e547acf750a386af 6734 web optional roundcube_1.6.20+dfsg-0+d= eb13u1_source.buildinfo -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEERpy6p3b9sfzUdbME05pJnDwhpVIFAmrYeC8ACgkQ05pJnDwh pVLusw/9E0/NKOnaOak79G+0fdJgXf/LTK6mMNRwoxqOlmMonSCa2qQdwu2pdN18 XRfGtRloDkQdb4MKoDmTRQ87imp/4TkLyCxbvs+bhwoS/y9U37HQXn0rFuSBxlzV ciEw2mUuHl4t3sWknEhcTHTDYk6XwObaTBsM7XMieyMxVsBYuYAQRAC8fv3JXWH7 gHTU+5Xe8M90xYwl912uDtGqBPDq1nFLww0n60LmriRQtRoghmIjMivtB7N96Ybh zRlOCue71bQsdmYj/3SCumBaIZMlKwTfd8kZ0Rpfw2kqDtlvU4Ko4p9wU6ot9ery ii92r6GWQxRY+CWHjyB582UqvsAB4cSC/4SCAXCikwlUE200eU7oxMOxMyN47hQP 1ixlu4sQjYv34JaSLgFfvWZxQHIsCVFRN3bcW+PMBB5FF52ITC4HcUoO2T4eESC2 +YRIAbdqvlaWd2ACFmM+zxPnEBTEEZesH3nSQ9ENGYfffto4+vOHUOzF+y7HZ6n8 TCRRJogPL1XemBAO1gCUSr0fljfRTytJrO5fkP6uCdc4ZNA1T0pzzMA5FjEa9JD1 aooWBL3URQugJpodIAh/SIX8zOi6gG/a29o11mD+nqulJuoRNjPwNbnhh9GHOAdz Wljk9P/JqkA/Z8ViuqBUh2sW7SAsfrhC4HbOF4i+Lw06E/R0eOs=3D =3DYPW2 -----END PGP SIGNATURE----- --===============1631789297831297143== Content-Type: application/pgp-signature -----BEGIN PGP SIGNATURE----- iHUEABYIAB0WIQTziqJOuF8J+ZI8pJSb9qggYcy5IQUCauNKWgAKCRCb9qggYcy5 IWCpAQDGe4KiXN2YOQd7gwqY3+Lc54bO+nZHwg+4eZGmVzh1ogD/Y8Ge5YBZ6tfC DZd4z0HILDVhttj4yvHzbIF5IkyfVgg= =dHXf -----END PGP SIGNATURE----- --===============1631789297831297143==-- ]