[From nobody Wed Mar 25 12:51:06 2026 Received: (at 1131606-close) by bugs.debian.org; 25 Mar 2026 12:49:04 +0000 X-Spam-Checker-Version: SpamAssassin 4.0.1-bugs.debian.org_2005_01_02 (2024-03-25) on buxtehude.debian.org X-Spam-Level: X-Spam-Status: No, score=-113.1 required=4.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,FVGT_m_MULTI_ODD,HAS_BUG_NUMBER, MD5_SHA1_SUM,PGPSIGNATURE,RCVD_IN_DNSWL_MED,SPF_HELO_PASS,SPF_NONE, USER_IN_DKIM_WELCOMELIST autolearn=ham autolearn_force=no version=4.0.1-bugs.debian.org_2005_01_02 X-Spam-Bayes: score:0.0000 Tokens: new, 13; hammy, 150; neutral, 250; spammy, 0. spammytokens: hammytokens:0.000-+--HX-Debian:DAK, 0.000-+--H*rp:D*ftp-master.debian.org, 0.000-+--HX-DAK:process-upload, 0.000-+--UD:debian.tar.xz, 0.000-+--H*r:sk:fasolo. Return-path: <envelope@ftp-master.debian.org> Received: from mitropoulos.debian.org ([2001:648:2ffc:deb:216:61ff:fe9d:958d]:59290) by buxtehude.debian.org with esmtps (TLS1.3:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.96) (envelope-from <envelope@ftp-master.debian.org>) id 1w5NfU-001aHt-0O for 1131606-close@bugs.debian.org; Wed, 25 Mar 2026 12:49:04 +0000 Received: via submission from C=NA, ST=NA, L=Ankh Morpork, O=Debian SMTP, OU=Debian SMTP CA, CN=fasolo.debian.org, EMAIL=hostmaster@fasolo.debian.org (verified) by mitropoulos.debian.org with esmtps (TLS1.3:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.96) (envelope-from <envelope@ftp-master.debian.org>) id 1w5NfR-00G6tk-2h for 1131606-close@bugs.debian.org; Wed, 25 Mar 2026 12:49:01 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=ftp-master.debian.org; s=smtpauto.fasolo; h=Date:Message-Id:Content-Type: Subject:MIME-Version:To:Reply-To:From:Cc:Content-Transfer-Encoding:Content-ID :Content-Description:In-Reply-To:References; bh=Ga6lWqRoKPAbxScIdjH9FCmiaWUoK4pGa1BMjJZMLCs=; b=CsHdpGB60sEbMwf8xy8d5oULji 9ObU9DI17uU8xS5VOEuo4CscxN1JLJY1HZ2EyF0q5ZAckfSEba49e9Ck30A9WJVm1iF1E/1xmMo4y y/+LzA7717Fll6/K5gkc3zSTkM4hiQZ5ECGurqA8A9ubeu3m+ht99z7zPXyhSfcS7lOwPlhoy+UPr qwqV0O8eRBbZ5RTiMNHaYRCQJfzD45ufbvMZFAw6YWg6lO02mH86neZEV/v3C58wFMbHEedgnEpUG 2VQEtaTc6TvLVrkiIvpGeaRZbpgmh3fZDGdi16/BpNIFstZDWB2G4ddEqKNim5bbJjMORRCaQU9kV ITiiqHwQ==; Received: from dak by fasolo.debian.org with local (Exim 4.98.2) (envelope-from <envelope@ftp-master.debian.org>) id 1w5NfQ-00000001vY3-2oz5; Wed, 25 Mar 2026 12:49:00 +0000 From: Debian FTP Masters <ftpmaster@ftp-master.debian.org> Reply-To: Jordi Mallach <jordi@debian.org> To: 1131606-close@bugs.debian.org X-DAK: dak process-upload X-Debian: DAK X-Debian-Package: sogo Debian: DAK Debian-Changes: sogo_5.12.6-1_source.changes Debian-Source: sogo Debian-Version: 5.12.6-1 Debian-Architecture: source Debian-Suite: unstable Debian-Archive-Action: accept MIME-Version: 1.0 Subject: Bug#1131606: fixed in sogo 5.12.6-1 Content-Type: multipart/signed; micalg="pgp-sha256"; protocol="application/pgp-signature"; boundary="===============1498785528867319134==" Message-Id: <E1w5NfQ-00000001vY3-2oz5@fasolo.debian.org> Date: Wed, 25 Mar 2026 12:49:00 +0000 --===============1498785528867319134== Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Source: sogo Source-Version: 5.12.6-1 Done: Jordi Mallach <jordi@debian.org> We believe that the bug you reported is fixed in the latest version of sogo, which is due to be installed in the Debian FTP archive. A summary of the changes between this version and the previous one is attached. Thank you for reporting the bug, which will now be closed. If you have further comments please address them to 1131606@bugs.debian.org, and the maintainer will reopen the bug report if appropriate. Debian distribution maintenance software pp. Jordi Mallach <jordi@debian.org> (supplier of updated sogo package) (This message was generated automatically at their request; if you believe that there is a problem with it please contact the archive administrators by mailing ftpmaster@ftp-master.debian.org) -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Wed, 25 Mar 2026 12:03:46 +0100 Source: sogo Architecture: source Version: 5.12.6-1 Distribution: unstable Urgency: medium Maintainer: Debian SOGo Maintainers <pkg-sogo-maintainers@lists.alioth.debian= .org> Changed-By: Jordi Mallach <jordi@debian.org> Closes: 1130878 1131605 1131606 Changes: sogo (5.12.6-1) unstable; urgency=3Dmedium . * New upstream release. - [CVE-2025-33550] Issues with OTP renewal and length (closes: #1131606) - [CVE-2025-71276] XSS in events, tasks and contacts (closes: #1131605) - [CVE-2026-3054] XSS in unknown components (closes: #1130878) * Drop CVE-2025-63499.patch, included in release. * Update watch file to version 5. * Update copyright years. * Update Standards-Version to 4.7.3, with no changes needed. Checksums-Sha1: eb1e24632c376943fb95befc36dddc483677d78e 2291 sogo_5.12.6-1.dsc 4ca3db2d68b555a9435d26bcbe3f67f0fc379741 37849337 sogo_5.12.6.orig.tar.gz 448395d91538bd8815509fec6857880228f20c60 21252 sogo_5.12.6-1.debian.tar.xz 6a927a92dfcb2a5886f4de5f9bbdd956f0856ce9 13755 sogo_5.12.6-1_amd64.buildinfo Checksums-Sha256: 53828b9bf7a552e65c0ff658c112bdf1207fafb01acb8603d81d1cff8251813b 2291 sogo_5= .12.6-1.dsc 90a81733f4c75517cbcc16ac599d7b4a9d8b913b4cf449856d402a7928c08872 37849337 so= go_5.12.6.orig.tar.gz 6c7a0e2154ad893b813a75a51a58da62c6446fd84739fc6540e4412a72ab2ae5 21252 sogo_= 5.12.6-1.debian.tar.xz e18a8b52528cd6d9a1f1656df1af332b41968dc690da7510afa81f73cf9fa49f 13755 sogo_= 5.12.6-1_amd64.buildinfo Files: b8af9ee3d09b9228f1c2fb6f6ca0522e 2291 mail optional sogo_5.12.6-1.dsc 8a064a77e6931d093d23fc708e1296d9 37849337 mail optional sogo_5.12.6.orig.tar= .gz 0485e17c0e6ad7d1cf372710315a9eaa 21252 mail optional sogo_5.12.6-1.debian.ta= r.xz d37c062d94ba723e1bd943ae8db409f2 13755 mail optional sogo_5.12.6-1_amd64.bui= ldinfo -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEE6BdUhsApKYN8KGoWJVAvb8vjywQFAmnD1kkACgkQJVAvb8vj ywTROQ//b2gTxnBfdV2uJT/pyZWFMaUxcBzj3b+ahCybKAWVUf3xPlWOtKmIS5SC J/yGHLLuv6AHzHj5v+qzLMXPkCdvoszMqnG7+dbDzInYKhgImAUbx7ZgQbX7eBOd cfYsNmbIJM25kHbx0s3ueGrAHORU/V3sGC/UmyNfGyj3I6mMMHBmp8IcEX56MJ33 yydoYOVTnQUytwFvpfEA1eZq0I8Z5Sx/XYZc2TQcxFaA4IFRXtMSyJe1L6yF8/tL 3Q2Nxb6k6Lko5Bwe+iD+gpMWWFVNgBkvE/j7lZ1sV8o8QME/SggJaLyrLge9klkB lem4Zl6hmCi09OcZ7FHfscRZ0+4uEiCdZ73beCTQxaAiFkiggfxXA1vvTxwOZoi/ PTFvKvz4h2aF1+tutI2bd903W+mG3HXRMe9KeJr6/q92V19Ao5FwFRtY9euzFbJN eNnmF141bDQaF7XK2F3t6QfAdnktyV0GNDY3gtFDKU7lGvEK5D6rBWltKQZYjFIc /Gh0VE6+QL16IY+kqdd8nEmcoSwxR4siXSs+GiOS5aF43oUyWGpJG2lqKdg4yoA/ AMuni/BenL7YZze/d+/nRwk96Z3BE9TWHW2VYs/x81lfMA5IRPwW78r6Mo0SVHJa lsO7Zddd0OFcyftAWsQsIk1AdUKE1/FZMkKUZQC480qHyB25rzQ=3D =3DKiVQ -----END PGP SIGNATURE----- --===============1498785528867319134== Content-Type: application/pgp-signature -----BEGIN PGP SIGNATURE----- iHUEABYIAB0WIQTziqJOuF8J+ZI8pJSb9qggYcy5IQUCacPZvAAKCRCb9qggYcy5 IXaJAP9jIUgp85GdpK305hHFIxOJexBXPEQuQdWhHSA9Ucjs5QEA+ffohMRCM7GU fZGr+6RKMx82q8Npz5/OF988DAQHOQI= =exfs -----END PGP SIGNATURE----- --===============1498785528867319134==-- ]