[Pkg-roundcube-maintainers] roundcube_1.6.18+dfsg-1_source.changes ACCEPTED into unstable

[Debian FTP Masters]

Thank you for your contribution to Debian.



Accepted:

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Mon, 10 Aug 2026 15:15:16 +0200
Source: roundcube
Architecture: source
Version: 1.6.18+dfsg-1
Distribution: unstable
Urgency: high
Maintainer: Debian Roundcube Maintainers <pkg-roundcube-maintainers at alioth-lists.debian.net>
Changed-By: Guilhem Moulin <guilhem at debian.org>
Closes: 1144059
Changes:
 roundcube (1.6.18+dfsg-1) unstable; urgency=high
 .
   * New upstream security and bugfix release (closes: #1144059).
     + Content proxied by the css proxy is not validated validation.
     + SSRF bypass via specific local address URLs using 100.64.0.0/10 and
       fe80::/10 subnets.
     + SSRF filter bypass via various forms of nip.io/sslip.io hostnames
       evading `is_local_url()` check.
     + Remote content blocking bypass via unclosed `url()` in a FuncIRI
       attribute.
     + LDAP filter injection via unescaped %u/%fu/%d substitution into the
       `search_filter`.
     + Arbitrary sieve script injection via a filter rule name bypassing
       `managesieve_disabled_actions`.
     + RCE in the `cmd_learn` driver of markasjunk plugin.
     + IMAP command injection via mail search and LITERAL+ byte-count
       desynchronization.
     + The modoboa driver of the passwd plugin leaks an authentication
       token to a user-controlled host.
     + Stored XSS in "Add to address book" action.
     + HTML/CSS sanitization bypass via SVG animate `by` attribute.
   * Refresh d/patches.
   * Cherry-pick follow-up change to fix PHP warning in markasjunk's
     cmd_learn.php.
Checksums-Sha1:
 7baebfb91ba8cd774b09a1bd9eba8aa358da1c5e 3845 roundcube_1.6.18+dfsg-1.dsc
 d1f446017c4ecc7d79a0ea6b465feb3fbee7b9c7 126948 roundcube_1.6.18+dfsg.orig-tinymce-langs.tar.xz
 af0bba30402c4c02beaca3ae96ac6aa12a4a6da6 1928640 roundcube_1.6.18+dfsg.orig-tinymce.tar.xz
 2b80f406956df4da1213893520778b94814aacd0 2907948 roundcube_1.6.18+dfsg.orig.tar.xz
 5ac234f7d61dc9868667328b0a4c4617739a8ebb 159932 roundcube_1.6.18+dfsg-1.debian.tar.xz
 2444dd3097df882acdd772fdca20517a664e9ce8 6267 roundcube_1.6.18+dfsg-1_source.buildinfo
Checksums-Sha256:
 23b49565b6327af40aad18bfe286f31846ea242b356a7ab420e3c26eb8959ae3 3845 roundcube_1.6.18+dfsg-1.dsc
 f009f44443e465cd7a06a758cb878402868f61b47762bf247f572fd2b3fd1bfb 126948 roundcube_1.6.18+dfsg.orig-tinymce-langs.tar.xz
 518547256094a0214580e18b22693cc63d54dd059d8a8116a967898c854a7acb 1928640 roundcube_1.6.18+dfsg.orig-tinymce.tar.xz
 b413364d67014758eb4a4b87adc2a0f465e0a0bedf23d644d61955280f1df900 2907948 roundcube_1.6.18+dfsg.orig.tar.xz
 1c542e61291d3fa88aa4f3012eecd69dbb549291572e2d97d270bf62ea85ce84 159932 roundcube_1.6.18+dfsg-1.debian.tar.xz
 8f31c303e98a4e46b1cf2528489ad219003b173f9a74fa5bd094de19604eac0c 6267 roundcube_1.6.18+dfsg-1_source.buildinfo
Files:
 cc4f51b8b3dd63b2d0dd5af04c67b65d 3845 web optional roundcube_1.6.18+dfsg-1.dsc
 6d1099a82016ca3d45dbba79295f6e30 126948 web optional roundcube_1.6.18+dfsg.orig-tinymce-langs.tar.xz
 49949888729c8204636bc14cffcfa003 1928640 web optional roundcube_1.6.18+dfsg.orig-tinymce.tar.xz
 8e988bb1541cf388be0bd2630e01dc90 2907948 web optional roundcube_1.6.18+dfsg.orig.tar.xz
 37bae46e8fd6d258d674b855336ceea8 159932 web optional roundcube_1.6.18+dfsg-1.debian.tar.xz
 6c177af0cd190b55038131044b936f6d 6267 web optional roundcube_1.6.18+dfsg-1_source.buildinfo

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEERpy6p3b9sfzUdbME05pJnDwhpVIFAmp6RvgACgkQ05pJnDwh
pVK7GQ/8DWHdVZIVwciMppsNtzrrBlT14Hhq4XzHJRrFYPO9gGjl7NfU3kubRBqD
C3OqRAznGR5jWJEGNODdKqnE/gG7wd3fp5D5wlljpsCtp4knjuqV0JWqf95WI3f1
qyv4MI8Lo2RDCQ0+zfUd1chnHFj8sX8jJKBYSyUVGA2ZuTUnVBvvLHavzz79lRGY
cgp+CSkYMHLDSgUF6YjwtHf40myCWhtIPCj+HoTIc7jLXXT7ugmLeEXB0wN/SRmK
wJhxJtBJ4aeiLlwtAsv1aLAelpreyHw+9506wg5hLSXaTZOHAWxTzw4LZkOX1KSV
CHwO+3fECnp96ieJR3LH7m9GRizgVCwOKg+N1DQdwTmutOT+NP01YE/Tl5P0LBFv
XZRvS5/zFxz1T9SbNGCMJZLIhQb+6i5kl5c+XYHYuHxGLovbLal3rMg+TwyZi2Au
wijKc9BGVUVX3NpHrvYywnbIsu6OAFNmsBGIK/Ml1Mx51rxojhCSNo/oHkoTSUtP
Wlesnod5vyRT08sOLvC2F1Fo2hCbKbR3fQKzIBHomk+gJ4KSMB9tDvWpYOls8LD+
ObD5racM2b8OcfzpwFHvplzCVOYKbyBxJXSRa5LD/c/v94+2bueG2KOLSLvRmhr4
BovKQKTKzdQEUJnBCl5ytWMPFvYIH+DfBqd2tyPydI7Z3tM7FEs=
=Z2b7
-----END PGP SIGNATURE-----

-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 228 bytes
Desc: not available
URL: <http://alioth-lists.debian.net/pipermail/pkg-roundcube-maintainers/attachments/20260810/b4ee6a4c/attachment-0001.sig>