[Pkg-roundcube-maintainers] roundcube_1.6.17+dfsg-1_source.changes ACCEPTED into unstable

[Debian FTP Masters]

Thank you for your contribution to Debian.



Accepted:

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Sun, 05 Jul 2026 17:26:53 +0200
Source: roundcube
Architecture: source
Version: 1.6.17+dfsg-1
Distribution: unstable
Urgency: high
Maintainer: Debian Roundcube Maintainers <pkg-roundcube-maintainers at alioth-lists.debian.net>
Changed-By: Guilhem Moulin <guilhem at debian.org>
Closes: 1138086 1141495
Changes:
 roundcube (1.6.17+dfsg-1) unstable; urgency=high
 .
   * New upstream security and bugfix release (closes: #1141495).
     + Fix infinite loop in TNEF (winmail.dat) decoder.
     + Fix various vulnerabilities in the password plugin using
       session-injected username.
     + Fix CVE-2026-54432: Stored XSS via unescaped attachment MIME type on the
       attachment-validation warning page.
     + Fix SSRF bypass via specific local address URLs.
     + Fix CVE-2026-54433: Zero-click stored XSS in plain-text rendering.
     + Fix DoS via crafted compressed-RTF size in the TNEF (winmail.dat) file.
     + Enigma: Add support for automatic public key lookup (import) using HKP
       v1 protocol.
     + Enigma: Add support for Kolab's Web Of Anti-Trust (WOAT) feature.
   * d/p/Avoid-dependency-on-new-package-mlocati-ip-lib.patch: Improve patch
     and drop type annotations to restore compatibility with PHP<8 (closes:
     #1138086).
Checksums-Sha1:
 cc90069cc1df4a571acd39ce7d8b196b3729a2b2 3845 roundcube_1.6.17+dfsg-1.dsc
 c42a03f7b7f449f7ec9023843d775b66e2887e31 126836 roundcube_1.6.17+dfsg.orig-tinymce-langs.tar.xz
 a14b229b6767817fb36d85c6c22b700e81fcc74a 1928888 roundcube_1.6.17+dfsg.orig-tinymce.tar.xz
 1f753251c7e378540cea602af4a7f5db415764fa 2906816 roundcube_1.6.17+dfsg.orig.tar.xz
 3e31aaa811424ffebdd43e601f014e46a56d6b6c 159116 roundcube_1.6.17+dfsg-1.debian.tar.xz
 cc5c4a419d387e71bd5a5047ed7b18e3f518ce0d 6227 roundcube_1.6.17+dfsg-1_source.buildinfo
Checksums-Sha256:
 5ddbaa4318bc081ac0b28d46522d702fb3a89220ca26038c7e20e4588ee4a65b 3845 roundcube_1.6.17+dfsg-1.dsc
 a9e0dcf588cdfd398b1ffacb63d3cc6cf2132785adcf98b9bc3cb7b23f9f1f6e 126836 roundcube_1.6.17+dfsg.orig-tinymce-langs.tar.xz
 870c74fc7fe5f66929a8f45b7340be3d542d94ef5786d92393bfbf687c57b1fa 1928888 roundcube_1.6.17+dfsg.orig-tinymce.tar.xz
 c32cae39892d8936f1b07712e0cda3f435d311cd095e6d949d8e62c473ae1426 2906816 roundcube_1.6.17+dfsg.orig.tar.xz
 d4a4cfd1cc4c48007af7e059cb201ba800b92ec1185f7f3d2f0c5429e25e9367 159116 roundcube_1.6.17+dfsg-1.debian.tar.xz
 87e264d6e5a915851d22b91aeaab2652671903f08c8f57690fb931aaa0edceef 6227 roundcube_1.6.17+dfsg-1_source.buildinfo
Files:
 b9a10be22b02a0bf26798952f2d58b30 3845 web optional roundcube_1.6.17+dfsg-1.dsc
 14e66bb6839218d4add3e1fbea68952d 126836 web optional roundcube_1.6.17+dfsg.orig-tinymce-langs.tar.xz
 d1198f417f0ae874dedee8a12e7c8713 1928888 web optional roundcube_1.6.17+dfsg.orig-tinymce.tar.xz
 dc32d01c80607b6c6ab3a206e354e584 2906816 web optional roundcube_1.6.17+dfsg.orig.tar.xz
 66ef61fd6e2c2ba68d5731a617f3c9d1 159116 web optional roundcube_1.6.17+dfsg-1.debian.tar.xz
 fa5e7976140601b140b3b19a0214fb9d 6227 web optional roundcube_1.6.17+dfsg-1_source.buildinfo

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEERpy6p3b9sfzUdbME05pJnDwhpVIFAmpKebwACgkQ05pJnDwh
pVKMjQ/9FASx8Pq8QeLmityAdMYXFizs6anN2uBThC1gIvWtRrL6bogVQTbUILWM
ISZKtGsxgSn6MA4vKU2ILbJdidb1mN+Hc+7TdOaWqxQEcX+tsFzuV4oJbAhyurzM
rm+uPytsTEekBfTBjYTbNaLsj4WE+0qHTLnGjUgHGk3DK9w48tvIBoJnxWYIuq1D
/7n2OP8sPEsXlmuey47wBF7xhvgj2krBOpDOPjAoROuNK0foc3zcFmSvDDx/2Ldv
ooE0DUkq/iQPcJw/1a+UrxqyIYNoD40qq7avTF4uF6vRgta2mNOyOBHwMcioPqlq
RvUYLlMp18vy9TtkK9HFcnN9PEAuiNpGPbS5tNhxXXfT9uZpZTgHqBgIPd0UfAM4
Oe61c06IRA9XYHayR8zpabguRsNn2GdJxJO74HXzI9Q5gxy1WW8lAL9KR9IuUsEV
eZNHvUtELqth2O/c1xWuLurYxZAiFjCtzK7Xg4mLT18CEXduR24WrQU5mFZN4ApQ
c+tQNdSY3XiQ+JcQY9klPdjb0PborZH2PShLUOAYUTR9R2XZlMvuzRIogaxnel2v
YPO8HA6QrVZNCmvfVTkkwJBRiywXfCqKPSmjHJiEaSTQVdqJ8F1o2vLI+3h0ECyw
h/wLup2HG2YhezdBw9g8xwZCtL4OAP2In3HCNd6cnJaLdLjSFGo=
=dyWy
-----END PGP SIGNATURE-----

-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 228 bytes
Desc: not available
URL: <http://alioth-lists.debian.net/pipermail/pkg-roundcube-maintainers/attachments/20260705/6a70a34d/attachment.sig>