[Pkg-roundcube-maintainers] roundcube_1.6.17+dfsg-0+deb13u1_source.changes ACCEPTED into proposed-updates

[Debian FTP Masters]

Thank you for your contribution to Debian.



Accepted:

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Wed, 08 Jul 2026 12:46:28 +0200
Source: roundcube
Architecture: source
Version: 1.6.17+dfsg-0+deb13u1
Distribution: trixie-security
Urgency: high
Maintainer: Debian Roundcube Maintainers <pkg-roundcube-maintainers at alioth-lists.debian.net>
Changed-By: Guilhem Moulin <guilhem at debian.org>
Closes: 1138086 1141495
Changes:
 roundcube (1.6.17+dfsg-0+deb13u1) trixie-security; urgency=high
 .
   * New upstream security and bugfix release (closes: #1141495).
     + Fix CVE-2026-62642: Infinite loop in TNEF (winmail.dat) decoder.
     + Fix CVE-2026-62644: Various vulnerabilities in the password plugin using
       session-injected username.
     + Fix CVE-2026-54432: Stored XSS via unescaped attachment MIME type on the
       attachment-validation warning page.
     + Fix CVE-2026-62643: SSRF bypass via specific local address URLs.
     + Fix CVE-2026-54433: Zero-click stored XSS in plain-text rendering.
     + Fix CVE-2026-62641: DoS via crafted compressed-RTF size in the TNEF
       (winmail.dat) file.
     + Enigma: Add support for automatic public key lookup (import) using HKP
       v1 protocol.
     + Enigma: Add support for Kolab's Web Of Anti-Trust (WOAT) feature.
   * d/p/Avoid-dependency-on-new-package-mlocati-ip-lib.patch: Improve patch
     and drop type annotations to restore compatibility with PHP<8 (closes:
     #1138086).
   * Refresh d/patches.
Checksums-Sha1:
 49a5435593fa17063d28734aeadfb72ab0238f67 3860 roundcube_1.6.17+dfsg-0+deb13u1.dsc
 c42a03f7b7f449f7ec9023843d775b66e2887e31 126836 roundcube_1.6.17+dfsg.orig-tinymce-langs.tar.xz
 a14b229b6767817fb36d85c6c22b700e81fcc74a 1928888 roundcube_1.6.17+dfsg.orig-tinymce.tar.xz
 1f753251c7e378540cea602af4a7f5db415764fa 2906816 roundcube_1.6.17+dfsg.orig.tar.xz
 17ff58ec398626d36c55feda9620efc00f4871ba 157648 roundcube_1.6.17+dfsg-0+deb13u1.debian.tar.xz
 0b149df20a93f3ad1a11319b242b2cf565a59952 6256 roundcube_1.6.17+dfsg-0+deb13u1_source.buildinfo
Checksums-Sha256:
 921dd7ea1f6d00ee1ffdf4c3d490fd5fd2e50351b344ebda9962d29668e49399 3860 roundcube_1.6.17+dfsg-0+deb13u1.dsc
 a9e0dcf588cdfd398b1ffacb63d3cc6cf2132785adcf98b9bc3cb7b23f9f1f6e 126836 roundcube_1.6.17+dfsg.orig-tinymce-langs.tar.xz
 870c74fc7fe5f66929a8f45b7340be3d542d94ef5786d92393bfbf687c57b1fa 1928888 roundcube_1.6.17+dfsg.orig-tinymce.tar.xz
 c32cae39892d8936f1b07712e0cda3f435d311cd095e6d949d8e62c473ae1426 2906816 roundcube_1.6.17+dfsg.orig.tar.xz
 1c961cee680df5c0a37d474f51663f4bbff85a3fbe67cd60fafb253623f54e5e 157648 roundcube_1.6.17+dfsg-0+deb13u1.debian.tar.xz
 a809dad1f9367a68c04d292ab86caef14fe164f24b976af2c62a6787bbd55e77 6256 roundcube_1.6.17+dfsg-0+deb13u1_source.buildinfo
Files:
 8694c4b8a031452951773cb5c74a1620 3860 web optional roundcube_1.6.17+dfsg-0+deb13u1.dsc
 14e66bb6839218d4add3e1fbea68952d 126836 web optional roundcube_1.6.17+dfsg.orig-tinymce-langs.tar.xz
 d1198f417f0ae874dedee8a12e7c8713 1928888 web optional roundcube_1.6.17+dfsg.orig-tinymce.tar.xz
 dc32d01c80607b6c6ab3a206e354e584 2906816 web optional roundcube_1.6.17+dfsg.orig.tar.xz
 eda7bcd661733eff99573717fca5beeb 157648 web optional roundcube_1.6.17+dfsg-0+deb13u1.debian.tar.xz
 d1251ffc0525b5bbaac880b1e8fe6601 6256 web optional roundcube_1.6.17+dfsg-0+deb13u1_source.buildinfo

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEERpy6p3b9sfzUdbME05pJnDwhpVIFAmpWxVgACgkQ05pJnDwh
pVIGRA//bGj8I891f1ENWx0y2oMV+Ef6/Lq8nXUArKAS3TZmfbyBrKRsvBjHECbl
rMzXz+rIJ1O9SO3zzR+IJpjjCdfvdkqR+R35X2p3ypZ4eogdVC56Kwvz3I1F6kq0
FWea9pOkN9zwuO8F6Rdwz9hE2Y8fw/oKqEFhU4YS/wKJCkpPFN7jvRlleLyjAO+I
oaO/++oSdddjFw5ZyZ340ESkQyvbaReoMQir2NG1TEO5gs6tzCjo1dCFA7Qh2gD8
zYVKcBwnuYl48FDvth+AC9ukDGStAJe+K7XG8me6zWtRpVofjgAsZhuJYnL+Xx6R
MM5iewx1s7JdAIZ2MqZn/QGxWFmJDFfjzuo/yYUbiysgXPP6Nnw584JPMJ1iFp4E
Kc04tn/lnUBC3dlSHkoiz0IJvlNtJf6UsrFZ7N3aDSG9qc2F45GnLaq+77zbPADr
r9EyWfcaLEODWStERAtmOrJkOhFpgH7PpyZAUF3AfnjCjWFZIWKG7zsE9cr9yReg
1nSVHag+Dfel5ntZKQECjQ9qipXUMaZm7OwRqTSo1q2Ce7EKGTsRbEPk56vZcTr0
90WCFKWaJ27nhvjADRJdbnf2abArIuqLP0diR9j+/FvMXEyuTn+w0UqqbQEoGUAq
a/QsMM1kmmQne5g7OT3xwpbx+GKwEN8vjjSc9jqUO8X8WhV40C0=
=bJ+5
-----END PGP SIGNATURE-----

-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 228 bytes
Desc: not available
URL: <http://alioth-lists.debian.net/pipermail/pkg-roundcube-maintainers/attachments/20260722/70794f5c/attachment.sig>