[Git][security-tracker-team/security-tracker][master] Reserve DSA number for roundcube update

Salvatore Bonaccorso (@carnil) carnil at debian.org
Tue Oct 6 06:09:50 BST 2026 


Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
cdfecdc0 by Salvatore Bonaccorso at 2026-10-06T07:09:25+02:00
Reserve DSA number for roundcube update

- - - - -


3 changed files:

- data/CVE/list
- data/DSA/list
- data/dsa-needed.txt


Changes:

=====================================
data/CVE/list
=====================================
@@ -40054,10 +40054,12 @@ CVE-2026-86219 (Authen::SASL::Perl::DIGEST_MD5 versions before 2.2100 for Perl a
 	NOTE: Fixed by: https://github.com/perl-authen-sasl/perl-authen-sasl/commit/94337367030612842924f697cead29964a96448d (v2.2100)
 CVE-2026-XXXX [CSS declaration smuggling via un-encoded ampersand emission]
 	- roundcube 1.6.19+dfsg-1 (bug #1146838)
+	[trixie] - roundcube 1.6.19+dfsg-0+deb13u1
 	[bookworm] - roundcube 1.6.5+dfsg-1+deb12u12
 	NOTE: Fixed by: https://github.com/roundcube/roundcubemail/commit/8119eb061bffd6d967ee34e7bda21e20237fc1e0 (1.6.19)
 CVE-2026-XXXX [CSS property injection via body `background` attribute]
 	- roundcube 1.6.19+dfsg-1 (bug #1146838)
+	[trixie] - roundcube 1.6.19+dfsg-0+deb13u1
 	[bookworm] - roundcube 1.6.5+dfsg-1+deb12u12
 	NOTE: Fixed by: https://github.com/roundcube/roundcubemail/commit/030de9a4e58699a336f62868017ea5271128c52f (1.6.19)
 	NOTE: Follow-up: https://github.com/roundcube/roundcubemail/commit/3092bd9fbe65b243cf419352ddd3e53e5086c6cc (1.6.19)
@@ -40065,39 +40067,48 @@ CVE-2026-XXXX [CSS property injection via body `background` attribute]
 	NOTE: Follow-up: https://github.com/roundcube/roundcubemail/commit/29beae7282135a3cd59a3945bd33ee8f904d6217 (1.6.19)
 CVE-2026-XXXX [Email header injection via bare CR in the subject field]
 	- roundcube 1.6.19+dfsg-1 (bug #1146838)
+	[trixie] - roundcube 1.6.19+dfsg-0+deb13u1
 	[bookworm] - roundcube 1.6.5+dfsg-1+deb12u12
 	NOTE: Fixed by: https://github.com/roundcube/roundcubemail/commit/73d864e06cb26000a37ad57ae439842a85b6690e (1.6.19)
 CVE-2026-XXXX [Email header injection via C-escape \r in the recipient display name]
 	- roundcube 1.6.19+dfsg-1 (bug #1146838)
+	[trixie] - roundcube 1.6.19+dfsg-0+deb13u1
 	[bookworm] - roundcube 1.6.5+dfsg-1+deb12u12
 	NOTE: Fixed by: https://github.com/roundcube/roundcubemail/commit/d1238ef1fb0d66a9bacf6b01926b911f70515071 (1.6.19)
 CVE-2026-XXXX [Email header injection via identity's organization field]
 	- roundcube 1.6.19+dfsg-1 (bug #1146838)
+	[trixie] - roundcube 1.6.19+dfsg-0+deb13u1
 	[bookworm] - roundcube 1.6.5+dfsg-1+deb12u12
 	NOTE: Fixed by: https://github.com/roundcube/roundcubemail/commit/11e5c9be0369e3b76bfee2ae095f57532bae0f1f (1.6.19)
 CVE-2026-XXXX [Zero-click stored XSS via TNEF MIME tag injection in the attachment URL]
 	- roundcube 1.6.19+dfsg-1 (bug #1146838)
+	[trixie] - roundcube 1.6.19+dfsg-0+deb13u1
 	[bookworm] - roundcube 1.6.5+dfsg-1+deb12u12
 	NOTE: Fixed by: https://github.com/roundcube/roundcubemail/commit/e4a0f82f4c648606de0867ee16b4a5f591ddbd69 (1.6.19)
 	NOTE: Follow-up: https://github.com/roundcube/roundcubemail/commit/7095e8d9de10d2f8bb90c3639c582edf8e371d5c (1.6.19)
 CVE-2026-XXXX [XSS in the HTML editor using text/enriched part content]
 	- roundcube 1.6.19+dfsg-1 (bug #1146838)
+	[trixie] - roundcube 1.6.19+dfsg-0+deb13u1
 	[bookworm] - roundcube 1.6.5+dfsg-1+deb12u12
 	NOTE: Fixed by: https://github.com/roundcube/roundcubemail/commit/1381bf5d7e4c595560acf0228a2e68e471cefbd8 (1.6.19)
 CVE-2026-XXXX [Cross-user access in contact group membership (add/remove) in the SQL address book]
 	- roundcube 1.6.19+dfsg-1 (bug #1146838)
+	[trixie] - roundcube 1.6.19+dfsg-0+deb13u1
 	[bookworm] - roundcube 1.6.5+dfsg-1+deb12u12
 	NOTE: Fixed by: https://github.com/roundcube/roundcubemail/commit/19ba077a859b590bd886b437a6c8a3fdd8aa3952 (1.6.19)
 CVE-2026-XXXX [`is_local_url()` bypass via trailing-dot FQDN in stylesheet URL]
 	- roundcube 1.6.19+dfsg-1 (bug #1146838)
+	[trixie] - roundcube 1.6.19+dfsg-0+deb13u1
 	[bookworm] - roundcube 1.6.5+dfsg-1+deb12u12
 	NOTE: Fixed by: https://github.com/roundcube/roundcubemail/commit/9c4099bbff33062c8ab6e09d9b71e59dde295408 (1.6.19)
 CVE-2026-XXXX [Remote content blocking bypass via CSS escapes in FuncIRI attributes]
 	- roundcube 1.6.19+dfsg-1 (bug #1146838)
+	[trixie] - roundcube 1.6.19+dfsg-0+deb13u1
 	[bookworm] - roundcube 1.6.5+dfsg-1+deb12u12
 	NOTE: Fixed by: https://github.com/roundcube/roundcubemail/commit/9aa2b3f13c3707ac24aee9899dd4ab693ee1e471 (1.6.19)
 CVE-2026-XXXX [Remote-content blocker bypass via SVG SMIL src animation]
 	- roundcube 1.6.19+dfsg-1 (bug #1146838)
+	[trixie] - roundcube 1.6.19+dfsg-0+deb13u1
 	[bookworm] - roundcube 1.6.5+dfsg-1+deb12u12
 	NOTE: Fixed by: https://github.com/roundcube/roundcubemail/commit/2bed9eeb5707636b8e5b915ae18d4d06b3971f31 (1.6.19)
 CVE-2026-XXXX [SSRF bypass in Roundcube CSS proxy via hexadecimal IPv6-mapped IPv4 addresses]


=====================================
data/DSA/list
=====================================
@@ -1,3 +1,5 @@
+[06 Oct 2026] DSA-6545-1 roundcube - security update
+	[trixie] - roundcube 1.6.19+dfsg-0+deb13u1
 [05 Oct 2026] DSA-6544-1 sabnzbdplus - security update
 	[trixie] - sabnzbdplus 4.5.0+dfsg-1+deb13u2
 [05 Oct 2026] DSA-6543-1 libreoffice - security update


=====================================
data/dsa-needed.txt
=====================================
@@ -149,8 +149,6 @@ rabbitmq-server
 rails
   Simon Quigley is proposing an update for trixie-security, <b2523fff-aae4-490f-a017-9b13b05d99c2 at tsimonq2.net>
 --
-roundcube (carnil)
---
 rtpengine
   Victor Seva prepared a debdiff for trixie-security for review, bookworm-security debdiff missing
 --



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/cdfecdc08c755d75c20d19687cc9f21383c95987

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/cdfecdc08c755d75c20d19687cc9f21383c95987
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261006/947ef64d/attachment-0001.htm>

More information about the debian-security-tracker-commits mailing list