From noreply at release.debian.org Tue Oct 6 05:40:32 2026 From: noreply at release.debian.org (Debian testing autoremoval watch) Date: Tue, 06 Oct 2026 04:40:32 +0000 Subject: [Pkg-roundcube-maintainers] php-roundcube-rtf-html-php is marked for autoremoval from testing Message-ID: php-roundcube-rtf-html-php 2.2-2 is marked for autoremoval from testing on 2026-11-10 It (build-)depends on packages with these RC bugs: 1149180: rabbitmq-server: CVE-2026-61837 CVE-2026-67223 CVE-2026-67239 CVE-2026-67241 CVE-2026-67242 CVE-2026-67406 CVE-2026-67407 CVE-2026-67408 CVE-2026-67409 CVE-2026-67410 CVE-2026-67411 CVE-2026-67412 CVE-2026-67413 CVE-2026-67415 CVE-2026-67419 CVE-2026-67420 CVE-2026-67421 https://bugs.debian.org/1149180 For more information on the autoremoval process, including hints to prevent autoremoval can be found on the wiki: https://wiki.debian.org/Autoremoval This mail is generated by: https://salsa.debian.org/release-team/release-tools/-/blob/master/mailer/mail_autoremovals.pl Autoremoval data is generated by: https://salsa.debian.org/qa/udd/-/blob/master/udd/testing_autoremovals_gatherer.pl From noreply at release.debian.org Tue Oct 6 05:40:54 2026 From: noreply at release.debian.org (Debian testing autoremoval watch) Date: Tue, 06 Oct 2026 04:40:54 +0000 Subject: [Pkg-roundcube-maintainers] roundcube-plugin-contextmenu is marked for autoremoval from testing Message-ID: roundcube-plugin-contextmenu 3.3.1+ds-2 is marked for autoremoval from testing on 2026-11-10 It (build-)depends on packages with these RC bugs: 1149180: rabbitmq-server: CVE-2026-61837 CVE-2026-67223 CVE-2026-67239 CVE-2026-67241 CVE-2026-67242 CVE-2026-67406 CVE-2026-67407 CVE-2026-67408 CVE-2026-67409 CVE-2026-67410 CVE-2026-67411 CVE-2026-67412 CVE-2026-67413 CVE-2026-67415 CVE-2026-67419 CVE-2026-67420 CVE-2026-67421 https://bugs.debian.org/1149180 For more information on the autoremoval process, including hints to prevent autoremoval can be found on the wiki: https://wiki.debian.org/Autoremoval This mail is generated by: https://salsa.debian.org/release-team/release-tools/-/blob/master/mailer/mail_autoremovals.pl Autoremoval data is generated by: https://salsa.debian.org/qa/udd/-/blob/master/udd/testing_autoremovals_gatherer.pl From noreply at release.debian.org Tue Oct 6 05:40:54 2026 From: noreply at release.debian.org (Debian testing autoremoval watch) Date: Tue, 06 Oct 2026 04:40:54 +0000 Subject: [Pkg-roundcube-maintainers] roundcube is marked for autoremoval from testing Message-ID: roundcube 1.6.19+dfsg-1 is marked for autoremoval from testing on 2026-11-10 It (build-)depends on packages with these RC bugs: 1149180: rabbitmq-server: CVE-2026-61837 CVE-2026-67223 CVE-2026-67239 CVE-2026-67241 CVE-2026-67242 CVE-2026-67406 CVE-2026-67407 CVE-2026-67408 CVE-2026-67409 CVE-2026-67410 CVE-2026-67411 CVE-2026-67412 CVE-2026-67413 CVE-2026-67415 CVE-2026-67419 CVE-2026-67420 CVE-2026-67421 https://bugs.debian.org/1149180 For more information on the autoremoval process, including hints to prevent autoremoval can be found on the wiki: https://wiki.debian.org/Autoremoval This mail is generated by: https://salsa.debian.org/release-team/release-tools/-/blob/master/mailer/mail_autoremovals.pl Autoremoval data is generated by: https://salsa.debian.org/qa/udd/-/blob/master/udd/testing_autoremovals_gatherer.pl From noreply at release.debian.org Tue Oct 6 05:40:54 2026 From: noreply at release.debian.org (Debian testing autoremoval watch) Date: Tue, 06 Oct 2026 04:40:54 +0000 Subject: [Pkg-roundcube-maintainers] roundcube-plugin-authres-status is marked for autoremoval from testing Message-ID: roundcube-plugin-authres-status 0.7.2+dfsg-1 is marked for autoremoval from testing on 2026-11-10 It (build-)depends on packages with these RC bugs: 1149180: rabbitmq-server: CVE-2026-61837 CVE-2026-67223 CVE-2026-67239 CVE-2026-67241 CVE-2026-67242 CVE-2026-67406 CVE-2026-67407 CVE-2026-67408 CVE-2026-67409 CVE-2026-67410 CVE-2026-67411 CVE-2026-67412 CVE-2026-67413 CVE-2026-67415 CVE-2026-67419 CVE-2026-67420 CVE-2026-67421 https://bugs.debian.org/1149180 For more information on the autoremoval process, including hints to prevent autoremoval can be found on the wiki: https://wiki.debian.org/Autoremoval This mail is generated by: https://salsa.debian.org/release-team/release-tools/-/blob/master/mailer/mail_autoremovals.pl Autoremoval data is generated by: https://salsa.debian.org/qa/udd/-/blob/master/udd/testing_autoremovals_gatherer.pl From noreply at release.debian.org Tue Oct 6 05:40:54 2026 From: noreply at release.debian.org (Debian testing autoremoval watch) Date: Tue, 06 Oct 2026 04:40:54 +0000 Subject: [Pkg-roundcube-maintainers] roundcube-plugin-compose-addressbook is marked for autoremoval from testing Message-ID: roundcube-plugin-compose-addressbook 8.0.4-1 is marked for autoremoval from testing on 2026-11-10 It (build-)depends on packages with these RC bugs: 1149180: rabbitmq-server: CVE-2026-61837 CVE-2026-67223 CVE-2026-67239 CVE-2026-67241 CVE-2026-67242 CVE-2026-67406 CVE-2026-67407 CVE-2026-67408 CVE-2026-67409 CVE-2026-67410 CVE-2026-67411 CVE-2026-67412 CVE-2026-67413 CVE-2026-67415 CVE-2026-67419 CVE-2026-67420 CVE-2026-67421 https://bugs.debian.org/1149180 For more information on the autoremoval process, including hints to prevent autoremoval can be found on the wiki: https://wiki.debian.org/Autoremoval This mail is generated by: https://salsa.debian.org/release-team/release-tools/-/blob/master/mailer/mail_autoremovals.pl Autoremoval data is generated by: https://salsa.debian.org/qa/udd/-/blob/master/udd/testing_autoremovals_gatherer.pl From noreply at release.debian.org Tue Oct 6 05:40:54 2026 From: noreply at release.debian.org (Debian testing autoremoval watch) Date: Tue, 06 Oct 2026 04:40:54 +0000 Subject: [Pkg-roundcube-maintainers] roundcube-plugin-html5-notifier is marked for autoremoval from testing Message-ID: roundcube-plugin-html5-notifier 0.6.4-1 is marked for autoremoval from testing on 2026-11-10 It (build-)depends on packages with these RC bugs: 1149180: rabbitmq-server: CVE-2026-61837 CVE-2026-67223 CVE-2026-67239 CVE-2026-67241 CVE-2026-67242 CVE-2026-67406 CVE-2026-67407 CVE-2026-67408 CVE-2026-67409 CVE-2026-67410 CVE-2026-67411 CVE-2026-67412 CVE-2026-67413 CVE-2026-67415 CVE-2026-67419 CVE-2026-67420 CVE-2026-67421 https://bugs.debian.org/1149180 For more information on the autoremoval process, including hints to prevent autoremoval can be found on the wiki: https://wiki.debian.org/Autoremoval This mail is generated by: https://salsa.debian.org/release-team/release-tools/-/blob/master/mailer/mail_autoremovals.pl Autoremoval data is generated by: https://salsa.debian.org/qa/udd/-/blob/master/udd/testing_autoremovals_gatherer.pl From noreply at release.debian.org Tue Oct 6 05:40:55 2026 From: noreply at release.debian.org (Debian testing autoremoval watch) Date: Tue, 06 Oct 2026 04:40:55 +0000 Subject: [Pkg-roundcube-maintainers] roundcube-plugin-keyboard-shortcuts is marked for autoremoval from testing Message-ID: roundcube-plugin-keyboard-shortcuts 3.1-1 is marked for autoremoval from testing on 2026-11-10 It (build-)depends on packages with these RC bugs: 1149180: rabbitmq-server: CVE-2026-61837 CVE-2026-67223 CVE-2026-67239 CVE-2026-67241 CVE-2026-67242 CVE-2026-67406 CVE-2026-67407 CVE-2026-67408 CVE-2026-67409 CVE-2026-67410 CVE-2026-67411 CVE-2026-67412 CVE-2026-67413 CVE-2026-67415 CVE-2026-67419 CVE-2026-67420 CVE-2026-67421 https://bugs.debian.org/1149180 For more information on the autoremoval process, including hints to prevent autoremoval can be found on the wiki: https://wiki.debian.org/Autoremoval This mail is generated by: https://salsa.debian.org/release-team/release-tools/-/blob/master/mailer/mail_autoremovals.pl Autoremoval data is generated by: https://salsa.debian.org/qa/udd/-/blob/master/udd/testing_autoremovals_gatherer.pl From noreply at release.debian.org Tue Oct 6 05:40:55 2026 From: noreply at release.debian.org (Debian testing autoremoval watch) Date: Tue, 06 Oct 2026 04:40:55 +0000 Subject: [Pkg-roundcube-maintainers] roundcube-plugin-listcommands is marked for autoremoval from testing Message-ID: roundcube-plugin-listcommands 2.7.1-1 is marked for autoremoval from testing on 2026-11-10 It (build-)depends on packages with these RC bugs: 1149180: rabbitmq-server: CVE-2026-61837 CVE-2026-67223 CVE-2026-67239 CVE-2026-67241 CVE-2026-67242 CVE-2026-67406 CVE-2026-67407 CVE-2026-67408 CVE-2026-67409 CVE-2026-67410 CVE-2026-67411 CVE-2026-67412 CVE-2026-67413 CVE-2026-67415 CVE-2026-67419 CVE-2026-67420 CVE-2026-67421 https://bugs.debian.org/1149180 For more information on the autoremoval process, including hints to prevent autoremoval can be found on the wiki: https://wiki.debian.org/Autoremoval This mail is generated by: https://salsa.debian.org/release-team/release-tools/-/blob/master/mailer/mail_autoremovals.pl Autoremoval data is generated by: https://salsa.debian.org/qa/udd/-/blob/master/udd/testing_autoremovals_gatherer.pl From ftpmaster at ftp-master.debian.org Tue Oct 6 06:34:02 2026 From: ftpmaster at ftp-master.debian.org (Debian FTP Masters) Date: Tue, 06 Oct 2026 05:34:02 +0000 Subject: [Pkg-roundcube-maintainers] roundcube_1.6.19+dfsg-0+deb13u1_source.changes ACCEPTED into proposed-updates->stable-new Message-ID: Thank you for your contribution to Debian. Mapping stable-security to proposed-updates. Accepted: -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Sun, 06 Sep 2026 13:22:41 +0200 Source: roundcube Architecture: source Version: 1.6.19+dfsg-0+deb13u1 Distribution: trixie-security Urgency: high Maintainer: Debian Roundcube Maintainers Changed-By: Guilhem Moulin Closes: 1146838 Changes: roundcube (1.6.19+dfsg-0+deb13u1) trixie-security; urgency=high . * New upstream security and bugfix release (closes: #1146838). + Fix CSS declaration smuggling via un-encoded ampersand emission. + Fix CSS property injection via body `background` attribute. + Fix email header injection via bare CR in the subject field. + Fix email header injection via C-escape `\r` in the recipient display name. + Fix email header injection via identity's organization field. + Fix zero-click stored XSS via TNEF MIME tag injection in the attachment URL. + Fix XSS in the HTML editor using text/enriched part content. + Fix cross-user access in contact group membership (add/remove) in the SQL address book. + Fix `is_local_url()` bypass via trailing-dot FQDN in stylesheet URL. + Fix remote content blocking bypass via CSS escapes in FuncIRI attributes. + Fix remote-content blocker bypass via SVG SMIL src animation. * Refresh d/patches and remove those applied upstream. Checksums-Sha1: abf62dd6b4459360ffeebfdb534b34f991e26857 3860 roundcube_1.6.19+dfsg-0+deb13u1.dsc 42a4a432e26557e1f256016fd70522a3e5fc7dd8 126884 roundcube_1.6.19+dfsg.orig-tinymce-langs.tar.xz f181c2ba04cea59621711962e3553c53e9d9882a 1928432 roundcube_1.6.19+dfsg.orig-tinymce.tar.xz 8c7c229d2ba194dc8dfb1874efb9b1401a786ff1 2910024 roundcube_1.6.19+dfsg.orig.tar.xz 51af771a0b18501a16527b46ca2e1fc06816fc89 158696 roundcube_1.6.19+dfsg-0+deb13u1.debian.tar.xz e1a03051a51563b0d244aa009a19c4f4168ad7df 6633 roundcube_1.6.19+dfsg-0+deb13u1_source.buildinfo Checksums-Sha256: 9e4fc3d1153b54397d74fd0ea4edbe6c3b18ea6f947885ecc004bf85ab5b7e13 3860 roundcube_1.6.19+dfsg-0+deb13u1.dsc 83b2d0ee3e4d937f86d1a8db01deed4c18c1d097a964a3134f9c0748c6eb0dfb 126884 roundcube_1.6.19+dfsg.orig-tinymce-langs.tar.xz d6a37e1987aa5c3b027f916f18ebbb778c38ee3e0cdf236ee88725ab07cdd6f9 1928432 roundcube_1.6.19+dfsg.orig-tinymce.tar.xz 10e6ffaeae68f5aa3d7c41fe5e5c29ca37df500ced8a2b75a0fae66f190050f1 2910024 roundcube_1.6.19+dfsg.orig.tar.xz a3de3cdfe507885459cfce4932b5b6ff1a213af54119d50ae7bc3219db64d6e5 158696 roundcube_1.6.19+dfsg-0+deb13u1.debian.tar.xz 46c42ca65a13c105099d70972a23a7fdc6b282541e2dff82d64c33d6cd6d0d8b 6633 roundcube_1.6.19+dfsg-0+deb13u1_source.buildinfo Files: 26adba7d4bf72a3d6ebcb8b118cad0b3 3860 web optional roundcube_1.6.19+dfsg-0+deb13u1.dsc 8ac2d1ce8d0f3d2979ad98f17a3a5090 126884 web optional roundcube_1.6.19+dfsg.orig-tinymce-langs.tar.xz 92283952d3baebc2b092c1298a7f4c0e 1928432 web optional roundcube_1.6.19+dfsg.orig-tinymce.tar.xz 5d27f90436ad392e742590cc0918a18f 2910024 web optional roundcube_1.6.19+dfsg.orig.tar.xz 20e2aac5f25eec65333982ce073acb66 158696 web optional roundcube_1.6.19+dfsg-0+deb13u1.debian.tar.xz dc22a9f63813ddaafe25d59fc20f8178 6633 web optional roundcube_1.6.19+dfsg-0+deb13u1_source.buildinfo -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEERpy6p3b9sfzUdbME05pJnDwhpVIFAmrD94wACgkQ05pJnDwh pVLa9g//VZBBNRaQINXz9/8PFXfjlENS72pmSiAnTotXsHsX/r6gQDV6HuOu+rUE hgHT2V5ZJXe/CaQfLHodSBIjqf2SdDi/7xADyrsnqSc+Qq4V9on25YSj9J6pyRSA PIixw7TE8a+K+SD9RNGTryXdBVOHBdxDLUA5bh1a2R2RcwswxRT4ozpAyKLm7T1Q uhiP7X8gEHafJ9n58yzXS5iI1UrieZb1uhMP7oTpKhgufVgkOnv5o6ppGPMJejtW gzoECHGrZoadtkGCM7+RzzjJccntQgoJ+XVeKeCMc5y41Vxm+7RnDzJy0IYpepp5 whUjUbYcHbNMj7s8t3+BNfMqc6Ukuf0H7IV0iWuJ0aYcWgsKIYKMKQ33u8xInGBw hS1f2G0I2PLslIv00AVZsR0ba4goEH/FsydCxboFU4IfI1PsdhFrBdH/g16OBLx5 5+gMxGxjyyzN1I3BTHvZ4VXrbvlmd/60nflIt/EOPA1nte177guhKtcnHrVkV+6X J2Yf9xH+gzqtfy3wIFlS6IeFTmZBdzgpFQ/8V1mVoOU/wks7XAV1bc6jAFXY5a2s Th9uNYVb+I+me9fEoEDIKoqo3SQYM5h4RmBwzP96LQ5AlFzXVhX0Tyuur2ZbKis9 tJ5H4vz8+b6HlAMvsP8NsDuIhqRrxx0D3yOr1tbTibH1Bug4GdE= =K6yv -----END PGP SIGNATURE----- -------------- next part -------------- A non-text attachment was scrubbed... Name: not available Type: application/pgp-signature Size: 228 bytes Desc: not available URL: From noreply at release.debian.org Tue Oct 6 05:40:55 2026 From: noreply at release.debian.org (Debian testing autoremoval watch) Date: Tue, 06 Oct 2026 04:40:55 +0000 Subject: [Pkg-roundcube-maintainers] roundcube-plugin-message-highlight is marked for autoremoval from testing Message-ID: roundcube-plugin-message-highlight 4.4-1 is marked for autoremoval from testing on 2026-11-10 It (build-)depends on packages with these RC bugs: 1149180: rabbitmq-server: CVE-2026-61837 CVE-2026-67223 CVE-2026-67239 CVE-2026-67241 CVE-2026-67242 CVE-2026-67406 CVE-2026-67407 CVE-2026-67408 CVE-2026-67409 CVE-2026-67410 CVE-2026-67411 CVE-2026-67412 CVE-2026-67413 CVE-2026-67415 CVE-2026-67419 CVE-2026-67420 CVE-2026-67421 https://bugs.debian.org/1149180 For more information on the autoremoval process, including hints to prevent autoremoval can be found on the wiki: https://wiki.debian.org/Autoremoval This mail is generated by: https://salsa.debian.org/release-team/release-tools/-/blob/master/mailer/mail_autoremovals.pl Autoremoval data is generated by: https://salsa.debian.org/qa/udd/-/blob/master/udd/testing_autoremovals_gatherer.pl From noreply at release.debian.org Tue Oct 6 05:40:55 2026 From: noreply at release.debian.org (Debian testing autoremoval watch) Date: Tue, 06 Oct 2026 04:40:55 +0000 Subject: [Pkg-roundcube-maintainers] roundcube-plugin-thunderbird-labels is marked for autoremoval from testing Message-ID: roundcube-plugin-thunderbird-labels 1.6.2-1 is marked for autoremoval from testing on 2026-11-10 It (build-)depends on packages with these RC bugs: 1149180: rabbitmq-server: CVE-2026-61837 CVE-2026-67223 CVE-2026-67239 CVE-2026-67241 CVE-2026-67242 CVE-2026-67406 CVE-2026-67407 CVE-2026-67408 CVE-2026-67409 CVE-2026-67410 CVE-2026-67411 CVE-2026-67412 CVE-2026-67413 CVE-2026-67415 CVE-2026-67419 CVE-2026-67420 CVE-2026-67421 https://bugs.debian.org/1149180 For more information on the autoremoval process, including hints to prevent autoremoval can be found on the wiki: https://wiki.debian.org/Autoremoval This mail is generated by: https://salsa.debian.org/release-team/release-tools/-/blob/master/mailer/mail_autoremovals.pl Autoremoval data is generated by: https://salsa.debian.org/qa/udd/-/blob/master/udd/testing_autoremovals_gatherer.pl From noreply at release.debian.org Tue Oct 6 05:40:55 2026 From: noreply at release.debian.org (Debian testing autoremoval watch) Date: Tue, 06 Oct 2026 04:40:55 +0000 Subject: [Pkg-roundcube-maintainers] roundcube-plugin-sauserprefs is marked for autoremoval from testing Message-ID: roundcube-plugin-sauserprefs 1.21+ds-2 is marked for autoremoval from testing on 2026-11-10 It (build-)depends on packages with these RC bugs: 1149180: rabbitmq-server: CVE-2026-61837 CVE-2026-67223 CVE-2026-67239 CVE-2026-67241 CVE-2026-67242 CVE-2026-67406 CVE-2026-67407 CVE-2026-67408 CVE-2026-67409 CVE-2026-67410 CVE-2026-67411 CVE-2026-67412 CVE-2026-67413 CVE-2026-67415 CVE-2026-67419 CVE-2026-67420 CVE-2026-67421 https://bugs.debian.org/1149180 For more information on the autoremoval process, including hints to prevent autoremoval can be found on the wiki: https://wiki.debian.org/Autoremoval This mail is generated by: https://salsa.debian.org/release-team/release-tools/-/blob/master/mailer/mail_autoremovals.pl Autoremoval data is generated by: https://salsa.debian.org/qa/udd/-/blob/master/udd/testing_autoremovals_gatherer.pl From noreply at release.debian.org Tue Oct 6 05:40:55 2026 From: noreply at release.debian.org (Debian testing autoremoval watch) Date: Tue, 06 Oct 2026 04:40:55 +0000 Subject: [Pkg-roundcube-maintainers] roundcube-plugins-extra is marked for autoremoval from testing Message-ID: roundcube-plugins-extra 1.6-1 is marked for autoremoval from testing on 2026-11-10 It (build-)depends on packages with these RC bugs: 1149180: rabbitmq-server: CVE-2026-61837 CVE-2026-67223 CVE-2026-67239 CVE-2026-67241 CVE-2026-67242 CVE-2026-67406 CVE-2026-67407 CVE-2026-67408 CVE-2026-67409 CVE-2026-67410 CVE-2026-67411 CVE-2026-67412 CVE-2026-67413 CVE-2026-67415 CVE-2026-67419 CVE-2026-67420 CVE-2026-67421 https://bugs.debian.org/1149180 For more information on the autoremoval process, including hints to prevent autoremoval can be found on the wiki: https://wiki.debian.org/Autoremoval This mail is generated by: https://salsa.debian.org/release-team/release-tools/-/blob/master/mailer/mail_autoremovals.pl Autoremoval data is generated by: https://salsa.debian.org/qa/udd/-/blob/master/udd/testing_autoremovals_gatherer.pl From noreply at release.debian.org Tue Oct 6 05:40:54 2026 From: noreply at release.debian.org (Debian testing autoremoval watch) Date: Tue, 06 Oct 2026 04:40:54 +0000 Subject: [Pkg-roundcube-maintainers] roundcube-plugin-dovecot-impersonate is marked for autoremoval from testing Message-ID: roundcube-plugin-dovecot-impersonate 2.1-1 is marked for autoremoval from testing on 2026-11-10 It (build-)depends on packages with these RC bugs: 1149180: rabbitmq-server: CVE-2026-61837 CVE-2026-67223 CVE-2026-67239 CVE-2026-67241 CVE-2026-67242 CVE-2026-67406 CVE-2026-67407 CVE-2026-67408 CVE-2026-67409 CVE-2026-67410 CVE-2026-67411 CVE-2026-67412 CVE-2026-67413 CVE-2026-67415 CVE-2026-67419 CVE-2026-67420 CVE-2026-67421 https://bugs.debian.org/1149180 For more information on the autoremoval process, including hints to prevent autoremoval can be found on the wiki: https://wiki.debian.org/Autoremoval This mail is generated by: https://salsa.debian.org/release-team/release-tools/-/blob/master/mailer/mail_autoremovals.pl Autoremoval data is generated by: https://salsa.debian.org/qa/udd/-/blob/master/udd/testing_autoremovals_gatherer.pl From noreply at release.debian.org Tue Oct 6 05:40:54 2026 From: noreply at release.debian.org (Debian testing autoremoval watch) Date: Tue, 06 Oct 2026 04:40:54 +0000 Subject: [Pkg-roundcube-maintainers] roundcube-plugin-fail2ban is marked for autoremoval from testing Message-ID: roundcube-plugin-fail2ban 1.3-1 is marked for autoremoval from testing on 2026-11-10 It (build-)depends on packages with these RC bugs: 1149180: rabbitmq-server: CVE-2026-61837 CVE-2026-67223 CVE-2026-67239 CVE-2026-67241 CVE-2026-67242 CVE-2026-67406 CVE-2026-67407 CVE-2026-67408 CVE-2026-67409 CVE-2026-67410 CVE-2026-67411 CVE-2026-67412 CVE-2026-67413 CVE-2026-67415 CVE-2026-67419 CVE-2026-67420 CVE-2026-67421 https://bugs.debian.org/1149180 For more information on the autoremoval process, including hints to prevent autoremoval can be found on the wiki: https://wiki.debian.org/Autoremoval This mail is generated by: https://salsa.debian.org/release-team/release-tools/-/blob/master/mailer/mail_autoremovals.pl Autoremoval data is generated by: https://salsa.debian.org/qa/udd/-/blob/master/udd/testing_autoremovals_gatherer.pl From w.paszajew at gmail.com Sat Oct 10 08:54:39 2026 From: w.paszajew at gmail.com (Viktor Pashaiev) Date: Sat, 10 Oct 2026 00:54:39 -0700 (PDT) Subject: [Pkg-roundcube-maintainers] Bug#1150492: roundcube: FTBFS with PHP 8.5: TypeError in test_array_first Message-ID: <6ac9ef3f.7f5fc00d.19f568.d86b@mx.google.com> Package: roundcube Version: 1.6.19+dfsg-1 Severity: normal Tags: patch ftbfs User: ubuntu-devel at lists.ubuntu.com Usertags: origin-ubuntu stonking ubuntu-patch Dear Maintainer, Under PHP 8.5, array_first(array $array) is a strictly typed native function. Framework_Bootstrap::test_array_first asserted that non-array arguments (false, string) return null, which now throws TypeError: TypeError: array_first(): Argument #1 ($array) must be of type array, false given This causes the package test suite to fail under PHP 8.5. Upstream resolved this in commit 060fc95672498993d37e57f74d146a087eb572e0 by dropping the non-array assertions from the test. Attached is a patch backporting the upstream fix. Thanks, Viktor Pashaiev -------------- next part -------------- A non-text attachment was scrubbed... Name: php8.5-array-first-compat.patch Type: application/x-diff Size: 1166 bytes Desc: not available URL: From ftpmaster at ftp-master.debian.org Sun Oct 11 12:52:28 2026 From: ftpmaster at ftp-master.debian.org (Debian FTP Masters) Date: Sun, 11 Oct 2026 11:52:28 +0000 Subject: [Pkg-roundcube-maintainers] roundcube_1.6.19+dfsg-0+deb13u1_source.changes ACCEPTED into proposed-updates Message-ID: Thank you for your contribution to Debian. Accepted: -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Sun, 06 Sep 2026 13:22:41 +0200 Source: roundcube Architecture: source Version: 1.6.19+dfsg-0+deb13u1 Distribution: trixie-security Urgency: high Maintainer: Debian Roundcube Maintainers Changed-By: Guilhem Moulin Closes: 1146838 Changes: roundcube (1.6.19+dfsg-0+deb13u1) trixie-security; urgency=high . * New upstream security and bugfix release (closes: #1146838). + Fix CSS declaration smuggling via un-encoded ampersand emission. + Fix CSS property injection via body `background` attribute. + Fix email header injection via bare CR in the subject field. + Fix email header injection via C-escape `\r` in the recipient display name. + Fix email header injection via identity's organization field. + Fix zero-click stored XSS via TNEF MIME tag injection in the attachment URL. + Fix XSS in the HTML editor using text/enriched part content. + Fix cross-user access in contact group membership (add/remove) in the SQL address book. + Fix `is_local_url()` bypass via trailing-dot FQDN in stylesheet URL. + Fix remote content blocking bypass via CSS escapes in FuncIRI attributes. + Fix remote-content blocker bypass via SVG SMIL src animation. * Refresh d/patches and remove those applied upstream. Checksums-Sha1: abf62dd6b4459360ffeebfdb534b34f991e26857 3860 roundcube_1.6.19+dfsg-0+deb13u1.dsc 42a4a432e26557e1f256016fd70522a3e5fc7dd8 126884 roundcube_1.6.19+dfsg.orig-tinymce-langs.tar.xz f181c2ba04cea59621711962e3553c53e9d9882a 1928432 roundcube_1.6.19+dfsg.orig-tinymce.tar.xz 8c7c229d2ba194dc8dfb1874efb9b1401a786ff1 2910024 roundcube_1.6.19+dfsg.orig.tar.xz 51af771a0b18501a16527b46ca2e1fc06816fc89 158696 roundcube_1.6.19+dfsg-0+deb13u1.debian.tar.xz e1a03051a51563b0d244aa009a19c4f4168ad7df 6633 roundcube_1.6.19+dfsg-0+deb13u1_source.buildinfo Checksums-Sha256: 9e4fc3d1153b54397d74fd0ea4edbe6c3b18ea6f947885ecc004bf85ab5b7e13 3860 roundcube_1.6.19+dfsg-0+deb13u1.dsc 83b2d0ee3e4d937f86d1a8db01deed4c18c1d097a964a3134f9c0748c6eb0dfb 126884 roundcube_1.6.19+dfsg.orig-tinymce-langs.tar.xz d6a37e1987aa5c3b027f916f18ebbb778c38ee3e0cdf236ee88725ab07cdd6f9 1928432 roundcube_1.6.19+dfsg.orig-tinymce.tar.xz 10e6ffaeae68f5aa3d7c41fe5e5c29ca37df500ced8a2b75a0fae66f190050f1 2910024 roundcube_1.6.19+dfsg.orig.tar.xz a3de3cdfe507885459cfce4932b5b6ff1a213af54119d50ae7bc3219db64d6e5 158696 roundcube_1.6.19+dfsg-0+deb13u1.debian.tar.xz 46c42ca65a13c105099d70972a23a7fdc6b282541e2dff82d64c33d6cd6d0d8b 6633 roundcube_1.6.19+dfsg-0+deb13u1_source.buildinfo Files: 26adba7d4bf72a3d6ebcb8b118cad0b3 3860 web optional roundcube_1.6.19+dfsg-0+deb13u1.dsc 8ac2d1ce8d0f3d2979ad98f17a3a5090 126884 web optional roundcube_1.6.19+dfsg.orig-tinymce-langs.tar.xz 92283952d3baebc2b092c1298a7f4c0e 1928432 web optional roundcube_1.6.19+dfsg.orig-tinymce.tar.xz 5d27f90436ad392e742590cc0918a18f 2910024 web optional roundcube_1.6.19+dfsg.orig.tar.xz 20e2aac5f25eec65333982ce073acb66 158696 web optional roundcube_1.6.19+dfsg-0+deb13u1.debian.tar.xz dc22a9f63813ddaafe25d59fc20f8178 6633 web optional roundcube_1.6.19+dfsg-0+deb13u1_source.buildinfo -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEERpy6p3b9sfzUdbME05pJnDwhpVIFAmrD94wACgkQ05pJnDwh pVLa9g//VZBBNRaQINXz9/8PFXfjlENS72pmSiAnTotXsHsX/r6gQDV6HuOu+rUE hgHT2V5ZJXe/CaQfLHodSBIjqf2SdDi/7xADyrsnqSc+Qq4V9on25YSj9J6pyRSA PIixw7TE8a+K+SD9RNGTryXdBVOHBdxDLUA5bh1a2R2RcwswxRT4ozpAyKLm7T1Q uhiP7X8gEHafJ9n58yzXS5iI1UrieZb1uhMP7oTpKhgufVgkOnv5o6ppGPMJejtW gzoECHGrZoadtkGCM7+RzzjJccntQgoJ+XVeKeCMc5y41Vxm+7RnDzJy0IYpepp5 whUjUbYcHbNMj7s8t3+BNfMqc6Ukuf0H7IV0iWuJ0aYcWgsKIYKMKQ33u8xInGBw hS1f2G0I2PLslIv00AVZsR0ba4goEH/FsydCxboFU4IfI1PsdhFrBdH/g16OBLx5 5+gMxGxjyyzN1I3BTHvZ4VXrbvlmd/60nflIt/EOPA1nte177guhKtcnHrVkV+6X J2Yf9xH+gzqtfy3wIFlS6IeFTmZBdzgpFQ/8V1mVoOU/wks7XAV1bc6jAFXY5a2s Th9uNYVb+I+me9fEoEDIKoqo3SQYM5h4RmBwzP96LQ5AlFzXVhX0Tyuur2ZbKis9 tJ5H4vz8+b6HlAMvsP8NsDuIhqRrxx0D3yOr1tbTibH1Bug4GdE= =K6yv -----END PGP SIGNATURE----- -------------- next part -------------- A non-text attachment was scrubbed... Name: not available Type: application/pgp-signature Size: 228 bytes Desc: not available URL: From owner at bugs.debian.org Sun Oct 11 12:55:04 2026 From: owner at bugs.debian.org (Debian Bug Tracking System) Date: Sun, 11 Oct 2026 11:55:04 +0000 Subject: [Pkg-roundcube-maintainers] Bug#1146838: marked as done (roundcube: Multiple security vulnerabilities) References: Message-ID: Your message dated Sun, 11 Oct 2026 11:52:28 +0000 with message-id and subject line Bug#1146838: fixed in roundcube 1.6.19+dfsg-0+deb13u1 has caused the Debian Bug report #1146838, regarding roundcube: Multiple security vulnerabilities to be marked as done. This means that you claim that the problem has been dealt with. If this is not the case it is now your responsibility to reopen the Bug report if necessary, and/or fix the problem forthwith. (NB: If you are a system administrator and have no idea what this message is talking about, this may indicate a serious mail system misconfiguration somewhere. Please contact owner at bugs.debian.org immediately.) -- 1146838: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1146838 Debian Bug Tracking System Contact owner at bugs.debian.org with problems -------------- next part -------------- An embedded message was scrubbed... From: Guilhem Moulin Subject: roundcube: Multiple security vulnerabilities Date: Sun, 6 Sep 2026 11:31:01 +0200 Size: 6874 URL: -------------- next part -------------- An embedded message was scrubbed... From: Debian FTP Masters Subject: Bug#1146838: fixed in roundcube 1.6.19+dfsg-0+deb13u1 Date: Sun, 11 Oct 2026 11:52:28 +0000 Size: 8636 URL: From guilhem at debian.org Mon Oct 19 15:22:07 2026 From: guilhem at debian.org (Guilhem Moulin) Date: Mon, 19 Oct 2026 16:22:07 +0200 Subject: [Pkg-roundcube-maintainers] Bug#1151279: roundcube: Multiple security vulnerabilities Message-ID: Source: roundcube Version: 1.6.19+dfsg-1 Control: found -1 1.6.19+dfsg-0+deb13u1 Control: found -1 1.6.5+dfsg-1+deb12u12 Severity: important Tags: security upstream X-Debbugs-Cc: Debian Security Team Roundcube webmail upstream has just released 1.6.20 [0] which fixes a new batch of security vulnerabilities: * Fix IMAP command injection via CRLF in _uid parameter of mail/headers and mail/viewsource action https://github.com/roundcube/roundcubemail/commit/f62879defc0330ae240c72b83b2d00a8ab337447 * Fix bug where an alias login wasn?t qualified by IMAP host https://github.com/roundcube/roundcubemail/commit/cb235cbfef88cbf78236dc67d3b667bf3dc61ddd * Add a size limit to the CSS proxy content processing https://github.com/roundcube/roundcubemail/commit/99a5bdd05b01f45493cc0da4c96968eac7668126 * Fix SSRF filter (is_local_url()) bypass via NAT64 64:ff9b::/96 https://github.com/roundcube/roundcubemail/commit/3c3a65f66b53b7aaf3d720acd06e0b102eceb090 * Fix remote content blocking bypass via SVG SMIL by attribute https://github.com/roundcube/roundcubemail/commit/2b6ff79d8b14f94b0ff04765b7f02dbfdfe98efa * Fix remote content blocking bypass via CSS escapes in FuncIRI attributes (again) https://github.com/roundcube/roundcubemail/commit/ff4fcfdd2952f9d09947cc9c18137f381f27caf1 * Fix passing potentally unsafe attachment content into ImageMagick on image resize https://github.com/roundcube/roundcubemail/commit/895d88af37720d2b46e4553f524013b2e1cb7665 * Fix mail header injection via the From display-name in the Bounce (resend) action https://github.com/roundcube/roundcubemail/commit/3a136465c965776a5f636587187626985dae4f3b * Fix mail header injection via References/In-Reply-To/Message-ID/From parameters https://github.com/roundcube/roundcubemail/commit/79adcfc0c48012bbbe930278471425027fd7331c * Fix object injection primitive in rcube_session::unserialize() via ?!?-prefixed session keys https://github.com/roundcube/roundcubemail/commit/833770d3d3c35cfde74cc2614d368f25a75b6f99 * Fix ImageMagick resource limits bypass by GD fallback during thumbnail generation https://github.com/roundcube/roundcubemail/commit/0bea81121efd96f07432a837f391dbdd0dffa33f * Fix CSS scoping bypass in HTML messages using at-rules https://github.com/roundcube/roundcubemail/commit/ff9cf4a9bf3b7c66db9afe43fe5f1cc73b47ed35 * Fix bug where deprecated action aliases bypassed disabled_actions setting https://github.com/roundcube/roundcubemail/commit/e7c512ae09ebd0ae5d0d2f29e00a767bf91f6bbe * Fix IMAP command injection via CRLF in _flag parameter of mail/mark action https://github.com/roundcube/roundcubemail/commit/242c6d6a150c850bd96d20d400261e71f8d11f9b * Fix CSRF validation bypass in the mark-as-junk action https://github.com/roundcube/roundcubemail/commit/15b0dc0d6e5712310c8f663577361bf8132a7f81 * Fix XSS issue in handling of password driver error responses https://github.com/roundcube/roundcubemail/commit/94298856ee67ff7817cc4def2adb634be91e28c7 * Fix mail header injection via subject of a message forwarded as attachment https://github.com/roundcube/roundcubemail/commit/c325953a251d0132f1909569b3eac0b974095dd4 * Fix mail header injection via media type in an inline image data URI https://github.com/roundcube/roundcubemail/commit/adb9b9b3fd43e30af1c166b79494726d89f828eb * Fix bug where Password Modoboa driver could change password for another account https://github.com/roundcube/roundcubemail/commit/3d9d05bfe2da7f93b8d47e68cadab22bb67e6cc9 * Fix unsafe use of a login name in SquirrelMail import file path https://github.com/roundcube/roundcubemail/commit/15fd175d154311ca7f59cf696c6cc39471611aa6 AFAIK no CVE-ID have been published for these issues. I'm quite busy this week and will probably not find time to file MITRE's form before the week-end. -- Guilhem. [0] https://roundcube.net/news/2026/10/19/security-updates-1.6.20-and-1.7.5 https://github.com/roundcube/roundcubemail/releases/tag/1.6.20 -------------- next part -------------- A non-text attachment was scrubbed... Name: signature.asc Type: application/pgp-signature Size: 833 bytes Desc: not available URL: From owner at bugs.debian.org Mon Oct 19 15:25:06 2026 From: owner at bugs.debian.org (Debian Bug Tracking System) Date: Mon, 19 Oct 2026 14:25:06 +0000 Subject: [Pkg-roundcube-maintainers] Processed: roundcube: Multiple security vulnerabilities References: Message-ID: Processing control commands: > found -1 1.6.19+dfsg-0+deb13u1 Bug #1151279 [src:roundcube] roundcube: Multiple security vulnerabilities Marked as found in versions roundcube/1.6.19+dfsg-0+deb13u1. > found -1 1.6.5+dfsg-1+deb12u12 Bug #1151279 [src:roundcube] roundcube: Multiple security vulnerabilities The source 'roundcube' and version '1.6.5+dfsg-1+deb12u12' do not appear to match any binary packages Marked as found in versions roundcube/1.6.5+dfsg-1+deb12u12. -- 1151279: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1151279 Debian Bug Tracking System Contact owner at bugs.debian.org with problems From guilhem at debian.org Mon Oct 19 16:28:50 2026 From: guilhem at debian.org (Guilhem Moulin) Date: Mon, 19 Oct 2026 17:28:50 +0200 Subject: [Pkg-roundcube-maintainers] Bug#1150492: roundcube: FTBFS with PHP 8.5: TypeError in test_array_first In-Reply-To: <6ac9ef3f.7f5fc00d.19f568.d86b@mx.google.com> References: <6ac9ef3f.7f5fc00d.19f568.d86b@mx.google.com> <6ac9ef3f.7f5fc00d.19f568.d86b@mx.google.com> Message-ID: Control: severity -1 wishlist Hi, On Sat, 10 Oct 2026 at 00:54:39 -0700, Viktor Pashaiev wrote: > Under PHP 8.5, array_first(array $array) is a strictly typed native function. > Framework_Bootstrap::test_array_first asserted that non-array arguments > (false, string) return null, which now throws TypeError: > TypeError: array_first(): Argument #1 ($array) must be of type array, false given > > This causes the package test suite to fail under PHP 8.5. AFAICT Roundcube 1.6.x is not officially supported with PHP 8.5, so I'm lowering the severity accordingly. I hope to find time to finalize packaging 1.7.x for forky. -- Guilhem. -------------- next part -------------- A non-text attachment was scrubbed... Name: signature.asc Type: application/pgp-signature Size: 833 bytes Desc: not available URL: From owner at bugs.debian.org Mon Oct 19 16:31:02 2026 From: owner at bugs.debian.org (Debian Bug Tracking System) Date: Mon, 19 Oct 2026 15:31:02 +0000 Subject: [Pkg-roundcube-maintainers] Processed: Re: Bug#1150492: roundcube: FTBFS with PHP 8.5: TypeError in test_array_first References: <6ac9ef3f.7f5fc00d.19f568.d86b@mx.google.com> Message-ID: Processing control commands: > severity -1 wishlist Bug #1150492 [roundcube] roundcube: FTBFS with PHP 8.5: TypeError in test_array_first Severity set to 'wishlist' from 'normal' -- 1150492: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1150492 Debian Bug Tracking System Contact owner at bugs.debian.org with problems From edmund at proteamail.com Mon Oct 19 16:38:58 2026 From: edmund at proteamail.com (Edmund Lodewijks) Date: Mon, 19 Oct 2026 17:38:58 +0200 Subject: [Pkg-roundcube-maintainers] Bug#1151279: roundcube: Multiple security vulnerabilities In-Reply-To: References: Message-ID: <1b33d43f-b118-4bea-b2ac-178b6d9bd723@proteamail.com> On 2026/10/19 16:22, Guilhem Moulin wrote: > Source: roundcube > Version: 1.6.19+dfsg-1 > Control: found -1 1.6.19+dfsg-0+deb13u1 > Control: found -1 1.6.5+dfsg-1+deb12u12 > Severity: important > Tags: security upstream > X-Debbugs-Cc: Debian Security Team > > Roundcube webmail upstream has just released 1.6.20 [0] which fixes a > new batch of security vulnerabilities: > ... > AFAIK no CVE-ID have been published for these issues. I'm quite busy this week and will > probably not find time to file MITRE's form before the week-end. I can help out with filing for CVE ID's, if no objection. Kind regards, Edmund -- Edmund Lodewijks TZ: UTC+2 / GMT+2 -------------- next part -------------- A non-text attachment was scrubbed... Name: OpenPGP_signature.asc Type: application/pgp-signature Size: 236 bytes Desc: OpenPGP digital signature URL: From guilhem at debian.org Mon Oct 19 16:40:12 2026 From: guilhem at debian.org (Guilhem Moulin) Date: Mon, 19 Oct 2026 17:40:12 +0200 Subject: [Pkg-roundcube-maintainers] Bug#1151279: roundcube: Multiple security vulnerabilities In-Reply-To: <1b33d43f-b118-4bea-b2ac-178b6d9bd723@proteamail.com> References: <1b33d43f-b118-4bea-b2ac-178b6d9bd723@proteamail.com> Message-ID: On Mon, 19 Oct 2026 at 17:38:58 +0200, Edmund Lodewijks wrote: > On 2026/10/19 16:22, Guilhem Moulin wrote: >> Roundcube webmail upstream has just released 1.6.20 [0] which fixes a >> new batch of security vulnerabilities: >> ... >> AFAIK no CVE-ID have been published for these issues. I'm quite busy this week and will >> probably not find time to file MITRE's form before the week-end. > > I can help out with filing for CVE ID's, if no objection. Go ahead, thanks! -- Guilhem. -------------- next part -------------- A non-text attachment was scrubbed... Name: signature.asc Type: application/pgp-signature Size: 833 bytes Desc: not available URL: From edmund at proteamail.com Mon Oct 19 16:38:58 2026 From: edmund at proteamail.com (Edmund Lodewijks) Date: Mon, 19 Oct 2026 17:38:58 +0200 Subject: [Pkg-roundcube-maintainers] Bug#1151279: roundcube: Multiple security vulnerabilities In-Reply-To: References: Message-ID: <1b33d43f-b118-4bea-b2ac-178b6d9bd723@proteamail.com> On 2026/10/19 16:22, Guilhem Moulin wrote: > Source: roundcube > Version: 1.6.19+dfsg-1 > Control: found -1 1.6.19+dfsg-0+deb13u1 > Control: found -1 1.6.5+dfsg-1+deb12u12 > Severity: important > Tags: security upstream > X-Debbugs-Cc: Debian Security Team > > Roundcube webmail upstream has just released 1.6.20 [0] which fixes a > new batch of security vulnerabilities: > ... > AFAIK no CVE-ID have been published for these issues. I'm quite busy this week and will > probably not find time to file MITRE's form before the week-end. I can help out with filing for CVE ID's, if no objection. Kind regards, Edmund -- Edmund Lodewijks TZ: UTC+2 / GMT+2 -------------- next part -------------- A non-text attachment was scrubbed... Name: OpenPGP_signature.asc Type: application/pgp-signature Size: 236 bytes Desc: OpenPGP digital signature URL: From ftpmaster at ftp-master.debian.org Mon Oct 19 16:54:46 2026 From: ftpmaster at ftp-master.debian.org (Debian FTP Masters) Date: Mon, 19 Oct 2026 15:54:46 +0000 Subject: [Pkg-roundcube-maintainers] Processing of roundcube-skin-classic_1.6.0+ds-4_source.changes Message-ID: roundcube-skin-classic_1.6.0+ds-4_source.changes uploaded successfully to localhost along with the files: roundcube-skin-classic_1.6.0+ds-4.dsc roundcube-skin-classic_1.6.0+ds-4.debian.tar.xz roundcube-skin-classic_1.6.0+ds-4_source.buildinfo Greetings, Your Debian queue daemon (running on host usper.debian.org) From ftpmaster at ftp-master.debian.org Mon Oct 19 16:59:49 2026 From: ftpmaster at ftp-master.debian.org (Debian FTP Masters) Date: Mon, 19 Oct 2026 15:59:49 +0000 Subject: [Pkg-roundcube-maintainers] Processing of roundcube-skin-larry_1.6.1+ds-4_source.changes Message-ID: roundcube-skin-larry_1.6.1+ds-4_source.changes uploaded successfully to localhost along with the files: roundcube-skin-larry_1.6.1+ds-4.dsc roundcube-skin-larry_1.6.1+ds-4.debian.tar.xz roundcube-skin-larry_1.6.1+ds-4_source.buildinfo Greetings, Your Debian queue daemon (running on host usper.debian.org) From ftpmaster at ftp-master.debian.org Mon Oct 19 17:06:20 2026 From: ftpmaster at ftp-master.debian.org (Debian FTP Masters) Date: Mon, 19 Oct 2026 16:06:20 +0000 Subject: [Pkg-roundcube-maintainers] roundcube-skin-classic_1.6.0+ds-4_source.changes ACCEPTED into unstable Message-ID: Thank you for your contribution to Debian. Accepted: -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Mon, 19 Oct 2026 17:48:34 +0200 Source: roundcube-skin-classic Architecture: source Version: 1.6.0+ds-4 Distribution: unstable Urgency: medium Maintainer: Debian Roundcube Maintainers Changed-By: Guilhem Moulin Changes: roundcube-skin-classic (1.6.0+ds-4) unstable; urgency=medium . * Update Standards-Version to 4.7.4. + Remove "Priority: optional" which is the current default and spelling it out is no longer recommended per Policy. * d/control: Remove `Rules-Requires-Root: no`. * d/watch: Port to Version 5. * Bump debhelper compatibility level to 14. Checksums-Sha1: 304e96bb33fe557bdab34ff9505085309d27e398 2144 roundcube-skin-classic_1.6.0+ds-4.dsc 8cc829445449cec78ac1df7ab4086493b6230dec 11360 roundcube-skin-classic_1.6.0+ds-4.debian.tar.xz 0110ea0476687b54b05ce5cfbce54a4b4df99c52 6295 roundcube-skin-classic_1.6.0+ds-4_source.buildinfo Checksums-Sha256: 6c926420ffb2467fca15db7329bb2df335e2e2720681f24ca28c5969da68ba15 2144 roundcube-skin-classic_1.6.0+ds-4.dsc b6bda3d28c62ef042e072b360557687feb40c0a1d99e05c356a3e73650acf285 11360 roundcube-skin-classic_1.6.0+ds-4.debian.tar.xz e3c0a393d1244b9b2bbffc7b87afae498475e325b414f49685b5ba6d7b7d2159 6295 roundcube-skin-classic_1.6.0+ds-4_source.buildinfo Files: bc2afe15f4abe37392bf310233bf8b3f 2144 web optional roundcube-skin-classic_1.6.0+ds-4.dsc cec4178266758525ff901b1c61000d06 11360 web optional roundcube-skin-classic_1.6.0+ds-4.debian.tar.xz b6a75c03c54eb5a2d4f898367ae563d7 6295 web optional roundcube-skin-classic_1.6.0+ds-4_source.buildinfo -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEERpy6p3b9sfzUdbME05pJnDwhpVIFAmrWPIQACgkQ05pJnDwh pVJPuBAAxctdBUYe9eNoenKqktw8vbKK4SxTOeKBRvHh6GgaBuqMLXemuNxYj27/ 2F6BMVRvZNjh6TiKdcsWwiFn64XWtYZjKXZqqRCXcr93EWrFKSru3FeD18uAnAau f3hietLrpkbjTeHbRpzegTLll3k6Z703kOvoZWAIlF4hv/QQC/F7+feD7NJnWxQC UybesrhlBZ7nPC8TcI4vOVenCJq1G4iNWGiTiMnotQqXsCmK84ArTRf/x2vkUt04 cOLlPNtA+HHOZ81TVwF1xTwOQi0zck/mSxMMxWII6VcagbITtJbj2d8IYTJtWjeS H6/YsHHegD1XIH3prkhCH1QIKlkEqL4wVYfZzzBNRuPI6MZoSpNwtclPFGZsM7YY aQg8+s+w4o5/B8Bf2k1rWSu+cxyX6LrVWAYqB69nbhT8WbKClJJQNNKzZPvEW41T jnN0WDJGqksKGnJY4CjfbQQtCOsCKFF0CMhADxczSUoWbL3J8X3KQDpo74pddtoD G0mzigZuARTw18aWzNo1voxTNj9FRj5w8M8dwy6PiO9g4aTQ5026u7ZoB+smOov6 X7mEGwzqxfiMrQcuMA11on8a0z/cbCNWtXqvDGqNTpG76HgRJTVK50opD3uInUDx ejT27SPqvZZW8UPq7mfdNPvJ9dy8uBLYb9XNHlrrcTSsfr75J4Y= =dpt2 -----END PGP SIGNATURE----- -------------- next part -------------- A non-text attachment was scrubbed... Name: not available Type: application/pgp-signature Size: 228 bytes Desc: not available URL: From ftpmaster at ftp-master.debian.org Mon Oct 19 17:06:25 2026 From: ftpmaster at ftp-master.debian.org (Debian FTP Masters) Date: Mon, 19 Oct 2026 16:06:25 +0000 Subject: [Pkg-roundcube-maintainers] roundcube-skin-larry_1.6.1+ds-4_source.changes ACCEPTED into unstable Message-ID: Thank you for your contribution to Debian. Accepted: -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Mon, 19 Oct 2026 17:54:32 +0200 Source: roundcube-skin-larry Architecture: source Version: 1.6.1+ds-4 Distribution: unstable Urgency: medium Maintainer: Debian Roundcube Maintainers Changed-By: Guilhem Moulin Changes: roundcube-skin-larry (1.6.1+ds-4) unstable; urgency=medium . * Update Standards-Version to 4.7.4. + Remove "Priority: optional" which is the current default and spelling it out is no longer recommended per Policy. * d/control: Remove `Rules-Requires-Root: no`. * d/watch: Port to Version 5. * Bump debhelper compatibility level to 14. Checksums-Sha1: 25f81cfa8b0955ad35c1f39f2226f6850f430631 2120 roundcube-skin-larry_1.6.1+ds-4.dsc b89d2375b1e069f876074382a4a2c245c87b43a4 11192 roundcube-skin-larry_1.6.1+ds-4.debian.tar.xz 65829c24dd3134e2740e9ed5f443bfad95d9030c 6287 roundcube-skin-larry_1.6.1+ds-4_source.buildinfo Checksums-Sha256: 5446569a0884799e152d6b3231a13a45ea7d3b13d420ffb94841a6481452ba99 2120 roundcube-skin-larry_1.6.1+ds-4.dsc adc83350cf69f0c653194fada9e51f62403e2b3b62e72507e06382b7d2d203bf 11192 roundcube-skin-larry_1.6.1+ds-4.debian.tar.xz c9127a7c7a248b682593a30ebea0fd7abfcd1a7d779f1c4508c01fe942d0ef3d 6287 roundcube-skin-larry_1.6.1+ds-4_source.buildinfo Files: 9da1095985c19d810f20b1a3da6cdc48 2120 web optional roundcube-skin-larry_1.6.1+ds-4.dsc b2003b02fc7bbe611d0287aac55736aa 11192 web optional roundcube-skin-larry_1.6.1+ds-4.debian.tar.xz 1e92a7ca79b22ad0248445cd2ab2609c 6287 web optional roundcube-skin-larry_1.6.1+ds-4_source.buildinfo -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEERpy6p3b9sfzUdbME05pJnDwhpVIFAmrWPYMACgkQ05pJnDwh pVJwOBAAl6Yt3JoJ1y5rdYssUTWG3Rr3Q7Ubf8pFHWRQphCv7AFxguWkLZAURzkd sMU+By9XK3Mi7VxJDAnMfvgqHMWQctwuGyvuzEO/PWrsew/RLCwYmqE0MnqzJp2d VZaFmSjY6yLs9mBrbxVyb7sT6mGMyCTBeWLFnCnIzyOWw4YEHQzlQ4BuSq/AJy2n mp7tQjfujd+oK4LaAiUe1W470UDw1Rp8IndhYWSTtPer/BtDvSsx4Gw4OrI1GgzX 8fHjEIxvNqEVTip2+nKMv521vu9AexZjtNbYoG7Iaq1RBMRVFMjujN4KvDKgyJnq hgXLmUxdigQ60SwtuD+1qjRXoxX2x4464SInx0MnTR5D8ZSC1/6KwyR9maGwp33F cukqXysUuYoh6cDss0LH3pRh8zi2ZhBAJOZWgLqUyLkcfbkGxOiQhSKpJKxx/fwy UdCSm8msFYTpcNlCTGw0x2GqY2PVrYGQwDXg+TA/tSr5CyQOs3Lg4i0qhtKu7Gud Peo5zve6BGDXtZK0oj4NLJCyXblJhzmGOLzdf8BJlPdR8Qc73dQ7Nl7kWUYxsccG dwcDX/yDcP8dvfzbCzsuaWggT00BPziVfGTD6wkPqKuiIb1dBT3jKmUZ0K+KhckF oWoMrGPvaE+3mGx7P/CTGwsJTyx5buHouvZ+8yS+S0Z0CW9aE5s= =zvYj -----END PGP SIGNATURE----- -------------- next part -------------- A non-text attachment was scrubbed... Name: not available Type: application/pgp-signature Size: 228 bytes Desc: not available URL: From ftpmaster at ftp-master.debian.org Mon Oct 19 17:15:01 2026 From: ftpmaster at ftp-master.debian.org (Debian FTP Masters) Date: Mon, 19 Oct 2026 16:15:01 +0000 Subject: [Pkg-roundcube-maintainers] Processing of roundcube_1.6.20+dfsg-1_source.changes Message-ID: roundcube_1.6.20+dfsg-1_source.changes uploaded successfully to localhost along with the files: roundcube_1.6.20+dfsg-1.dsc roundcube_1.6.20+dfsg.orig-tinymce-langs.tar.xz roundcube_1.6.20+dfsg.orig-tinymce.tar.xz roundcube_1.6.20+dfsg.orig.tar.xz roundcube_1.6.20+dfsg-1.debian.tar.xz roundcube_1.6.20+dfsg-1_source.buildinfo Greetings, Your Debian queue daemon (running on host usper.debian.org) From ftpmaster at ftp-master.debian.org Mon Oct 19 17:19:25 2026 From: ftpmaster at ftp-master.debian.org (Debian FTP Masters) Date: Mon, 19 Oct 2026 16:19:25 +0000 Subject: [Pkg-roundcube-maintainers] roundcube_1.6.20+dfsg-1_source.changes ACCEPTED into unstable Message-ID: Thank you for your contribution to Debian. Accepted: -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Mon, 19 Oct 2026 16:51:01 +0200 Source: roundcube Architecture: source Version: 1.6.20+dfsg-1 Distribution: unstable Urgency: medium Maintainer: Debian Roundcube Maintainers Changed-By: Guilhem Moulin Closes: 1151279 Changes: roundcube (1.6.20+dfsg-1) unstable; urgency=medium . * New upstream security and bugfix release (closes: #1151279). + Fix IMAP command injection via CRLF in `_uid` parameter of mail/headers and mail/viewsource action. + Fix bug where an alias login wasn't qualified by IMAP host. + Add a size limit to the CSS proxy content processing. + Fix SSRF filter (is_local_url()) bypass via NAT64 64:ff9b::/96. + Fix remote content blocking bypass via SVG SMIL `by` attribute. + Fix remote content blocking bypass via CSS escapes in FuncIRI attributes (again). + Fix passing potentially unsafe attachment content into ImageMagick on image resize. + Fix mail header injection via the From display-name in the Bounce (resend) action. + Fix mail header injection via References/In-Reply-To/Message-ID/From parameters. + Fix object injection primitive in rcube_session::unserialize() via ?!?-prefixed session keys. + Fix ImageMagick resource limits bypass by GD fallback during thumbnail generation. + Fix CSS scoping bypass in HTML messages using at-rules. + Fix bug where deprecated action aliases bypassed `disabled_actions` setting. + Fix IMAP command injection via CRLF in `_flag` parameter of mail/mark action. + Fix CSRF validation bypass in the mark-as-junk action. + Fix XSS issue in handling of password driver error responses. + Fix mail header injection via subject of a message forwarded as attachment. + Fix mail header injection via media type in an inline image data URI. + Fix bug where Password Modoboa driver could change password for another account. + Fix unsafe use of a login name in SquirrelMail import file path. * Remove `Depends: ${misc:Depends}` from the binary packages. * Refresh d/roundcube-core.lintian-overrides. Checksums-Sha1: 15788fa9018782f7800dd4e7c280a22f82d2f4cf 3845 roundcube_1.6.20+dfsg-1.dsc 32a740c50ee6ae83c79d675e539d9bb4ff86ca19 126856 roundcube_1.6.20+dfsg.orig-tinymce-langs.tar.xz c17351cead238baa4a63bce2b136ff054c2034f9 1928744 roundcube_1.6.20+dfsg.orig-tinymce.tar.xz d6cb3e64e6cef16458b627130240c0e7e88b7536 2921204 roundcube_1.6.20+dfsg.orig.tar.xz 12748f310f554dda71c7ff9eb85ee3c8fd57c223 160736 roundcube_1.6.20+dfsg-1.debian.tar.xz d5074c57b5ce2b37285b8d638a43fac0b0679d71 6606 roundcube_1.6.20+dfsg-1_source.buildinfo Checksums-Sha256: ad49d6e2c5b2456fd1181965d6e2d95b791550fb1fd49f5a8594c5b7db0f0286 3845 roundcube_1.6.20+dfsg-1.dsc b7968a5dd8a32fdbde4afd733111a6fd44cbfa346332bd07e4dcf2c5b09007cf 126856 roundcube_1.6.20+dfsg.orig-tinymce-langs.tar.xz 5f0d2f90355cd16d94d6be3e857995be0c4bad6b96cde894815901577eba5c34 1928744 roundcube_1.6.20+dfsg.orig-tinymce.tar.xz fa1b308c9e3169776321b80af6f1831329b1947a515a024fe9032e31055c3b39 2921204 roundcube_1.6.20+dfsg.orig.tar.xz 67eb7e731cd90162e0c4e094c6479ffc58c78b3482452c50e7ed194a5e957b7f 160736 roundcube_1.6.20+dfsg-1.debian.tar.xz 9983c4c0dceb08ac00793e7647c0260c2d85681693ad48f776404b6bde523e44 6606 roundcube_1.6.20+dfsg-1_source.buildinfo Files: 2b50841dc93f7b8d5f4e129b8816c61c 3845 web optional roundcube_1.6.20+dfsg-1.dsc 9f448ec4c449b2c7a9af1544112ef559 126856 web optional roundcube_1.6.20+dfsg.orig-tinymce-langs.tar.xz c7276aef6d00b70deda0abf66bc2e050 1928744 web optional roundcube_1.6.20+dfsg.orig-tinymce.tar.xz a7ab89080eb8e14bc5433bbd30b05120 2921204 web optional roundcube_1.6.20+dfsg.orig.tar.xz 4b02718efe18e2ffffbe2193f630da79 160736 web optional roundcube_1.6.20+dfsg-1.debian.tar.xz c94235c8487a69860e3762d710f6a96e 6606 web optional roundcube_1.6.20+dfsg-1_source.buildinfo -----BEGIN PGP SIGNATURE----- iQIyBAEBCgAdFiEERpy6p3b9sfzUdbME05pJnDwhpVIFAmrWPoEACgkQ05pJnDwh pVI7Ug/4zojdCk8ECAJ0ebvX7Rq6bCzGvUF/05TZnw+VlFnTrDnB1lUrR4eK8SPG Fn+6Vg8DzyqFdl5wsb4QGCdjGhzKdOOGW9QifKa2lbkN6fGbYIM4Q8CEDMr3jn1g aUbYzl94LA1MBdpr+SZrq1U8TpnR2r9NHvP7OckqRR8gN7SjdS37PiH36+8DsC5I 58YQm4jgH1NekIBRlFbysicyuHJMqe3KbEI1rZQ+s2QS0fDFyokfond9PGj1CP9e J7pH5/0yU2OJS0Yw1GErqbt7Z1rW4hNXCujmSORT2UYQ2sAuKX3SdKbvvUQMPZZN l68u9T06OjDxEZQVVRucRQkUDROp4t98vA6r+uVnHlfOV4L0NwpKyIYdhc5i64j4 Ph8Z7ViDgn022QbZNfaX9sWEUO7du/lPU03eFBjYKXU74UdDEvlZp5HE280W/uJd lUaWveT1dpMRo4SiLRDbelVSfvbzeguc2el7UKMpIj7H/vk2txyMY5AKz/FboQEE E5YxkUJ+ncuc4qPzQsgenYbbcpUjXG3O+a3/PbRJn99gKrxIiGY9T4r+KRdxBbAd L7zvBcaEDIzWlwPlwlYbtHreMizCd2glmivDQPtAIOXblUoq3m1frpS0Gm+Tubwm bgTalwF5Zfh9ktQxGpc/5WTxcd4wITSGkpwxHkZq0oPmgvo8/A== =eGBZ -----END PGP SIGNATURE----- -------------- next part -------------- A non-text attachment was scrubbed... Name: not available Type: application/pgp-signature Size: 228 bytes Desc: not available URL: From owner at bugs.debian.org Mon Oct 19 17:21:03 2026 From: owner at bugs.debian.org (Debian Bug Tracking System) Date: Mon, 19 Oct 2026 16:21:03 +0000 Subject: [Pkg-roundcube-maintainers] Bug#1151279: marked as done (roundcube: Multiple security vulnerabilities) References: Message-ID: Your message dated Mon, 19 Oct 2026 16:19:25 +0000 with message-id and subject line Bug#1151279: fixed in roundcube 1.6.20+dfsg-1 has caused the Debian Bug report #1151279, regarding roundcube: Multiple security vulnerabilities to be marked as done. This means that you claim that the problem has been dealt with. If this is not the case it is now your responsibility to reopen the Bug report if necessary, and/or fix the problem forthwith. (NB: If you are a system administrator and have no idea what this message is talking about, this may indicate a serious mail system misconfiguration somewhere. Please contact owner at bugs.debian.org immediately.) -- 1151279: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1151279 Debian Bug Tracking System Contact owner at bugs.debian.org with problems -------------- next part -------------- An embedded message was scrubbed... From: Guilhem Moulin Subject: roundcube: Multiple security vulnerabilities Date: Mon, 19 Oct 2026 16:22:07 +0200 Size: 7914 URL: -------------- next part -------------- An embedded message was scrubbed... From: Debian FTP Masters Subject: Bug#1151279: fixed in roundcube 1.6.20+dfsg-1 Date: Mon, 19 Oct 2026 16:19:25 +0000 Size: 9445 URL: From maya at nz4.dayangok.com Tue Oct 20 01:35:40 2026 From: maya at nz4.dayangok.com (maya) Date: Tue, 20 Oct 2026 00:35:40 -0000 Subject: [Pkg-roundcube-maintainers] [Black Friday] Discover Luxury Watches Starting at $250 Message-ID: An HTML attachment was scrubbed... URL: From owner at bugs.debian.org Tue Oct 20 13:19:02 2026 From: owner at bugs.debian.org (Debian Bug Tracking System) Date: Tue, 20 Oct 2026 12:19:02 +0000 Subject: [Pkg-roundcube-maintainers] Processed: tagging 1150492 References: <1792498585-231752002@bts.debian.org> Message-ID: Processing commands for control at bugs.debian.org: > tags 1150492 + upstream fixed-upstream Bug #1150492 [roundcube] roundcube: FTBFS with PHP 8.5: TypeError in test_array_first Added tag(s) fixed-upstream and upstream. > thanks Stopping processing here. Please contact me if you need assistance. -- 1150492: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1150492 Debian Bug Tracking System Contact owner at bugs.debian.org with problems From guilhem at debian.org Wed Oct 21 04:49:58 2026 From: guilhem at debian.org (Guilhem Moulin) Date: Wed, 21 Oct 2026 05:49:58 +0200 Subject: [Pkg-roundcube-maintainers] Bug#1151279: roundcube: Multiple security vulnerabilities In-Reply-To: References: Message-ID: Hi, On Mon, 19 Oct 2026 at 16:22:07 +0200, Guilhem Moulin wrote: > Roundcube webmail upstream has just released 1.6.20 [0] which fixes a > new batch of security vulnerabilities: As for the previous uploads, I suggest to follow 1.6.x (upstream's current LTS release) for trixie-security. The upstream diff [0] is targeted anyway. Several of the issues, in particular the SSRF, XSS and remote-content blocker bypass, have test coverage. Tested debdiff attached. Debusine result: https://debusine.debian.net/debian/developers/work-request/1508582/ Cheers, -- Guilhem. [0] https://github.com/roundcube/roundcubemail/compare/1.6.19...1.6.20 -------------- next part -------------- A non-text attachment was scrubbed... Name: signature.asc Type: application/pgp-signature Size: 833 bytes Desc: not available URL: From guilhem at debian.org Wed Oct 21 04:52:57 2026 From: guilhem at debian.org (Guilhem Moulin) Date: Wed, 21 Oct 2026 05:52:57 +0200 Subject: [Pkg-roundcube-maintainers] Bug#1151279: roundcube: Multiple security vulnerabilities In-Reply-To: References: Message-ID: On Wed, 21 Oct 2026 at 05:49:58 +0200, Guilhem Moulin wrote: > On Mon, 19 Oct 2026 at 16:22:07 +0200, Guilhem Moulin wrote: >> Roundcube webmail upstream has just released 1.6.20 [0] which fixes a >> new batch of security vulnerabilities: > > As for the previous uploads, I suggest to follow 1.6.x (upstream's > current LTS release) for trixie-security. The upstream diff [0] is > targeted anyway. Several of the issues, in particular the SSRF, XSS and > remote-content blocker bypass, have test coverage. > > Tested debdiff attached. Debusine result: > https://debusine.debian.net/debian/developers/work-request/1508582/ Oops, now with the right recipient and the attachment. -- Guilhem. -------------- next part -------------- diffstat for roundcube-1.6.19+dfsg roundcube-1.6.20+dfsg CHANGELOG.md | 23 + debian/changelog | 38 ++ debian/patches/Avoid-dependency-on-new-package-mlocati-ip-lib.patch | 22 - debian/patches/Fix-FTBFS-with-phpunit-11.patch | 148 +++++----- index.php | 10 plugins/markasjunk/markasjunk.php | 2 plugins/password/drivers/directadmin.php | 2 plugins/password/drivers/modoboa.php | 29 + plugins/password/password.php | 2 plugins/squirrelmail_usercopy/squirrelmail_usercopy.php | 5 program/actions/contacts/upload_photo.php | 2 program/actions/mail/compose.php | 6 program/actions/mail/headers.php | 3 program/actions/mail/viewsource.php | 3 program/actions/utils/modcss.php | 23 + program/include/rcmail.php | 25 + program/include/rcmail_attachment_handler.php | 3 program/include/rcmail_sendmail.php | 14 program/lib/Roundcube/rcube_image.php | 5 program/lib/Roundcube/rcube_imap_generic.php | 4 program/lib/Roundcube/rcube_mime.php | 3 program/lib/Roundcube/rcube_session.php | 9 program/lib/Roundcube/rcube_user.php | 4 program/lib/Roundcube/rcube_utils.php | 10 program/lib/Roundcube/rcube_washtml.php | 73 ++++ public_html/plugins/markasjunk/markasjunk.php | 2 public_html/plugins/password/drivers/directadmin.php | 2 public_html/plugins/password/drivers/modoboa.php | 29 + public_html/plugins/password/password.php | 2 public_html/plugins/squirrelmail_usercopy/squirrelmail_usercopy.php | 5 tests/Framework/Mime.php | 15 + tests/Framework/Utils.php | 22 + tests/Framework/Washtml.php | 49 +++ tests/Rcmail/Sendmail.php | 20 + tests/src/logo.jpg |binary 35 files changed, 462 insertions(+), 152 deletions(-) diff -Nru roundcube-1.6.19+dfsg/CHANGELOG.md roundcube-1.6.20+dfsg/CHANGELOG.md --- roundcube-1.6.19+dfsg/CHANGELOG.md 2026-09-06 10:27:09.000000000 +0200 +++ roundcube-1.6.20+dfsg/CHANGELOG.md 2026-10-19 08:49:43.000000000 +0200 @@ -2,6 +2,29 @@ ## Unreleased +- Security: Fix IMAP command injection via CRLF in `_uid` parameter of mail/headers and mail/viewsource action +- Security: Fix bug where an alias login wasn't qualified by IMAP host +- Security: Add a size limit to the CSS proxy content processing +- Security: Fix SSRF filter (is_local_url()) bypass via NAT64 64:ff9b::/96 +- Security: Fix remote content blocking bypass via SVG SMIL `by` attribute +- Security: Fix remote content blocking bypass via CSS escapes in FuncIRI attributes (again) +- Security: Fix passing potentally unsafe attachment content into ImageMagick on image resize +- Security: Fix mail header injection via the From display-name in the Bounce (resend) action +- Security: Fix mail header injection via References/In-Reply-To/Message-ID/From parameters +- Security: Fix object injection primitive in rcube_session::unserialize() via "!"-prefixed session keys +- Security: Fix ImageMagick resource limits bypass by GD fallback during thumbnail generation +- Security: Fix CSS scoping bypass in HTML messages using at-rules +- Security: Fix bug where deprecated action aliases bypassed `disabled_actions` setting +- Security: Fix IMAP command injection via CRLF in `_flag` parameter of mail/mark action +- Security: Fix CSRF validation bypass in the mark-as-junk action +- Security: Fix XSS issue in handling of password driver error responses +- Security: Fix mail header injection via subject of a message forwarded as attachment +- Security: Fix mail header injection via media type in an inline image data URI +- Security: Fix bug where Password Modoboa driver could change password for another account +- Security: Fix unsafe use of a login name in SquirrelMail import file path + +## Release 1.6.19 + - Fix PHP Warning: Undefined variable $tmp_command in .../plugins/markasjunk/drivers/cmd_learn.php (#10294) - Security: Fix CSS declaration smuggling via un-encoded ampersand emission - Security: Fix CSS property injection via body `background` attribute diff -Nru roundcube-1.6.19+dfsg/debian/changelog roundcube-1.6.20+dfsg/debian/changelog --- roundcube-1.6.19+dfsg/debian/changelog 2026-09-06 13:22:41.000000000 +0200 +++ roundcube-1.6.20+dfsg/debian/changelog 2026-10-20 07:00:29.000000000 +0200 @@ -1,3 +1,41 @@ +roundcube (1.6.20+dfsg-0+deb13u1) trixie-security; urgency=high + + * New upstream security and bugfix release (closes: #1151279). + + Fix CVE-2026-113386: IMAP command injection via CRLF in `_uid` parameter + of mail/headers and mail/viewsource action. + + Fix bug where an alias login wasn't qualified by IMAP host. + + Add a size limit to the CSS proxy content processing. + + Fix SSRF filter (`is_local_url()`) bypass via NAT64 64:ff9b::/96. + + Fix remote content blocking bypass via SVG SMIL `by` attribute. + + Fix remote content blocking bypass via CSS escapes in FuncIRI attributes + (again). + + Fix passing potentially unsafe attachment content into ImageMagick on + image resize. + + Fix mail header injection via the From display-name in the Bounce (resend) + action. + + Fix mail header injection via References/In-Reply-To/Message-ID/From + parameters. + + Fix object injection primitive in rcube_session::unserialize() via + ?!?-prefixed session keys. + + Fix ImageMagick resource limits bypass by GD fallback during thumbnail + generation. + + Fix CSS scoping bypass in HTML messages using at-rules. + + Fix bug where deprecated action aliases bypassed `disabled_actions` + setting. + + Fix IMAP command injection via CRLF in `_flag` parameter of mail/mark + action. + + Fix CSRF validation bypass in the mark-as-junk action. + + Fix XSS issue in handling of password driver error responses. + + Fix mail header injection via subject of a message forwarded as + attachment. + + Fix mail header injection via media type in an inline image data URI. + + Fix bug where Password Modoboa driver could change password for another + account. + + Fix unsafe use of a login name in SquirrelMail import file path. + * Refresh d/patches. + + -- Guilhem Moulin Tue, 20 Oct 2026 07:00:29 +0200 + roundcube (1.6.19+dfsg-0+deb13u1) trixie-security; urgency=high * New upstream security and bugfix release (closes: #1146838). diff -Nru roundcube-1.6.19+dfsg/debian/patches/Avoid-dependency-on-new-package-mlocati-ip-lib.patch roundcube-1.6.20+dfsg/debian/patches/Avoid-dependency-on-new-package-mlocati-ip-lib.patch --- roundcube-1.6.19+dfsg/debian/patches/Avoid-dependency-on-new-package-mlocati-ip-lib.patch 2026-09-06 13:22:41.000000000 +0200 +++ roundcube-1.6.20+dfsg/debian/patches/Avoid-dependency-on-new-package-mlocati-ip-lib.patch 2026-10-20 07:00:29.000000000 +0200 @@ -11,9 +11,9 @@ Forwarded: not-needed --- composer.json-dist | 3 +- - program/lib/Roundcube/rcube_utils.php | 163 +++++++++++++++++++++++++++++----- - tests/Framework/Utils.php | 85 ++++++++++++++++++ - 3 files changed, 225 insertions(+), 26 deletions(-) + program/lib/Roundcube/rcube_utils.php | 169 ++++++++++++++++++++++++++++------ + tests/Framework/Utils.php | 85 +++++++++++++++++ + 3 files changed, 228 insertions(+), 29 deletions(-) diff --git a/composer.json-dist b/composer.json-dist index 1807004..ca3de26 100644 @@ -30,7 +30,7 @@ "require-dev": { "phpunit/phpunit": "^9" diff --git a/program/lib/Roundcube/rcube_utils.php b/program/lib/Roundcube/rcube_utils.php -index b10103e..2c1aff8 100644 +index 270a14f..94f0fc4 100644 --- a/program/lib/Roundcube/rcube_utils.php +++ b/program/lib/Roundcube/rcube_utils.php @@ -1,8 +1,5 @@ @@ -171,7 +171,7 @@ $host = trim($host, '[].'); if (preg_match('/([0-9a-f.-]+)\.(nip|sslip)\.io$/i', $host, $matches)) { -@@ -452,26 +554,39 @@ class rcube_utils +@@ -452,29 +554,42 @@ class rcube_utils } } @@ -192,9 +192,12 @@ - '169.254.0.0/16', // link-local / cloud metadata - '100.64.0.0/10', // RFC6598: Shared Address Space (carrier-grade NAT) - '::1/128', +- '::/128', - 'fc00::/7', - 'fe80::/10', // IPv6 link-local - '::ffff:0:0/96', // RFC5156 +- '64:ff9b::/96', // RFC 6052 NAT64 (maps IPv4 incl. private ranges into IPv6) +- '64:ff9b:1::/48' // (RFC 8215 local-use NAT64) + if (is_string($address = \rcube_utils::inet_pton2($host))) { + $nets = [ + ['0.0.0.0', '0.0.0.0'], @@ -213,8 +216,11 @@ + } + } + $nets[] = ['::1', '::1']; ++ $nets[] = ['::', '::']; + $nets[] = ['fc00::', 'fdff:ffff:ffff:ffff:ffff:ffff:ffff:ffff']; + $nets[] = ['fe80::', 'febf:ffff:ffff:ffff:ffff:ffff:ffff:ffff']; // IPv6 link-local ++ $nets[] = ['64:ff9b::', '64:ff9b::ffff:ffff']; // RFC 6052 NAT64 (maps IPv4 incl. private ranges into IPv6) ++ $nets[] = ['64:ff9b:1::', '64:ff9b:1:ffff:ffff:ffff:ffff:ffff']; // (RFC 8215 local-use NAT64) + } - foreach ($nets as $net) { @@ -228,10 +234,10 @@ } } diff --git a/tests/Framework/Utils.php b/tests/Framework/Utils.php -index 98f53d0..757c1c4 100644 +index 4325b0b..5769772 100644 --- a/tests/Framework/Utils.php +++ b/tests/Framework/Utils.php -@@ -571,6 +571,86 @@ class Framework_Utils extends TestCase +@@ -588,6 +588,86 @@ class Framework_Utils extends TestCase } } @@ -318,7 +324,7 @@ /** * Test is_local_url() * -@@ -590,12 +670,17 @@ class Framework_Utils extends TestCase +@@ -607,12 +687,17 @@ class Framework_Utils extends TestCase return [ // Local hosts ['https://127.0.0.1', true], diff -Nru roundcube-1.6.19+dfsg/debian/patches/Fix-FTBFS-with-phpunit-11.patch roundcube-1.6.20+dfsg/debian/patches/Fix-FTBFS-with-phpunit-11.patch --- roundcube-1.6.19+dfsg/debian/patches/Fix-FTBFS-with-phpunit-11.patch 2026-09-06 13:22:41.000000000 +0200 +++ roundcube-1.6.20+dfsg/debian/patches/Fix-FTBFS-with-phpunit-11.patch 2026-10-20 07:00:29.000000000 +0200 @@ -8765,7 +8765,7 @@ } } diff --git a/tests/Framework/Mime.php b/tests/Framework/Mime.php -index abe9939..81d42f0 100644 +index b4266fd..602ffa9 100644 --- a/tests/Framework/Mime.php +++ b/tests/Framework/Mime.php @@ -1,11 +1,13 @@ @@ -8803,7 +8803,7 @@ $this->assertEquals($results[$idx], $res, "Decode address groups (#$idx)"); } -@@ -174,7 +176,7 @@ class Framework_Mime extends PHPUnit\Framework\TestCase +@@ -189,7 +191,7 @@ class Framework_Mime extends PHPUnit\Framework\TestCase ]; foreach ($test as $idx => $item) { @@ -8812,7 +8812,7 @@ $res = quoted_printable_encode($res); $this->assertEquals($item['out'], $res, "Header decoding for: " . $idx); -@@ -186,7 +188,7 @@ class Framework_Mime extends PHPUnit\Framework\TestCase +@@ -201,7 +203,7 @@ class Framework_Mime extends PHPUnit\Framework\TestCase */ function test_parse_headers() { @@ -8821,7 +8821,7 @@ $headers = "Subject: Test\r\n" -@@ -197,7 +199,7 @@ class Framework_Mime extends PHPUnit\Framework\TestCase +@@ -212,7 +214,7 @@ class Framework_Mime extends PHPUnit\Framework\TestCase 'to' => 'test at test1.com test at test2.com' ]; @@ -8830,7 +8830,7 @@ } /** -@@ -208,7 +210,7 @@ class Framework_Mime extends PHPUnit\Framework\TestCase +@@ -223,7 +225,7 @@ class Framework_Mime extends PHPUnit\Framework\TestCase $raw = file_get_contents(TESTS_DIR . 'src/format-flowed-unfolded.txt'); $flowed = file_get_contents(TESTS_DIR . 'src/format-flowed.txt'); @@ -8839,7 +8839,7 @@ } /** -@@ -219,7 +221,7 @@ class Framework_Mime extends PHPUnit\Framework\TestCase +@@ -234,7 +236,7 @@ class Framework_Mime extends PHPUnit\Framework\TestCase $flowed = file_get_contents(TESTS_DIR . 'src/format-flowed.txt'); $unfolded = file_get_contents(TESTS_DIR . 'src/format-flowed-unfolded.txt'); @@ -8848,7 +8848,7 @@ } /** -@@ -234,7 +236,7 @@ class Framework_Mime extends PHPUnit\Framework\TestCase +@@ -249,7 +251,7 @@ class Framework_Mime extends PHPUnit\Framework\TestCase ."> \r\n" ."Sed ut perspiciatis unde omnis iste natus error sit voluptatem"; @@ -8857,7 +8857,7 @@ } /** -@@ -248,7 +250,7 @@ class Framework_Mime extends PHPUnit\Framework\TestCase +@@ -263,7 +265,7 @@ class Framework_Mime extends PHPUnit\Framework\TestCase ."???????????"; $unfolded = "??????????????????????????????????????????????????????????????????????????"; @@ -8866,7 +8866,7 @@ } /** -@@ -306,8 +308,8 @@ class Framework_Mime extends PHPUnit\Framework\TestCase +@@ -321,8 +323,8 @@ class Framework_Mime extends PHPUnit\Framework\TestCase "this-is-just-some-blabla-to-make-this-more-than-seventy-five-characters-in-a-row\n-- this line should\nbe wrapped", ], [ @@ -8877,7 +8877,7 @@ ], ]; -@@ -322,9 +324,9 @@ class Framework_Mime extends PHPUnit\Framework\TestCase +@@ -337,9 +339,9 @@ class Framework_Mime extends PHPUnit\Framework\TestCase function test_parse_message() { $file = file_get_contents(__DIR__ . '/../src/html.msg'); @@ -8889,7 +8889,7 @@ $this->assertSame('multipart/alternative', $result->mimetype); $this->assertSame('1.0', $result->headers['mime-version']); $this->assertSame('=_68eeaf4ab95b5312965e45c33362338e', $result->ctype_parameters['boundary']); -@@ -355,9 +357,9 @@ class Framework_Mime extends PHPUnit\Framework\TestCase +@@ -370,9 +372,9 @@ class Framework_Mime extends PHPUnit\Framework\TestCase function test_file_content_type() { $file = INSTALL_PATH . 'program/resources/blocked.gif'; @@ -8901,7 +8901,7 @@ } /** -@@ -365,10 +367,10 @@ class Framework_Mime extends PHPUnit\Framework\TestCase +@@ -380,10 +382,10 @@ class Framework_Mime extends PHPUnit\Framework\TestCase */ function test_get_mime_extensions() { @@ -8916,7 +8916,7 @@ } /** -@@ -377,7 +379,7 @@ class Framework_Mime extends PHPUnit\Framework\TestCase +@@ -392,7 +394,7 @@ class Framework_Mime extends PHPUnit\Framework\TestCase function test_image_content_type() { $file = file_get_contents(INSTALL_PATH . 'program/resources/blocked.gif'); @@ -8925,7 +8925,7 @@ } /** -@@ -385,9 +387,9 @@ class Framework_Mime extends PHPUnit\Framework\TestCase +@@ -400,9 +402,9 @@ class Framework_Mime extends PHPUnit\Framework\TestCase */ function test_fix_mimetype() { @@ -10052,7 +10052,7 @@ $idents = $user->list_identities(); diff --git a/tests/Framework/Utils.php b/tests/Framework/Utils.php -index 26cf452..98f53d0 100644 +index 08d0880..4325b0b 100644 --- a/tests/Framework/Utils.php +++ b/tests/Framework/Utils.php @@ -1,11 +1,15 @@ @@ -10283,7 +10283,7 @@ $this->assertSame("#rcmbody { color: red; }", $mod); $style = 'body { background:url(alert('URL!')); }'; -@@ -343,7 +352,7 @@ class Framework_Utils extends PHPUnit\Framework\TestCase +@@ -360,7 +369,7 @@ class Framework_Utils extends PHPUnit\Framework\TestCase :root * { color: red; } :root > * { top: 0; } '; @@ -10292,7 +10292,7 @@ $this->assertStringContainsString('#rc .testone', $mod); $this->assertStringContainsString('#rc .testthree.testfour', $mod); -@@ -361,24 +370,24 @@ class Framework_Utils extends PHPUnit\Framework\TestCase +@@ -378,24 +387,24 @@ class Framework_Utils extends PHPUnit\Framework\TestCase function test_xss_entity_decode() { @@ -10322,7 +10322,7 @@ { return [ [ -@@ -453,9 +462,10 @@ class Framework_Utils extends PHPUnit\Framework\TestCase +@@ -470,9 +479,10 @@ class Framework_Utils extends PHPUnit\Framework\TestCase * * @dataProvider data_parse_css_block */ @@ -10334,7 +10334,7 @@ } /** -@@ -470,7 +480,7 @@ class Framework_Utils extends PHPUnit\Framework\TestCase +@@ -487,7 +497,7 @@ class Framework_Utils extends PHPUnit\Framework\TestCase ]; foreach ($data as $text => $res) { @@ -10343,7 +10343,7 @@ $this->assertSame($res, $result); } } -@@ -483,7 +493,7 @@ class Framework_Utils extends PHPUnit\Framework\TestCase +@@ -500,7 +510,7 @@ class Framework_Utils extends PHPUnit\Framework\TestCase $data = ['', 'a,b,c', 'a', ',', ',a']; foreach ($data as $text) { @@ -10352,7 +10352,7 @@ $this->assertSame(explode(',', $text), $result); } } -@@ -498,7 +508,7 @@ class Framework_Utils extends PHPUnit\Framework\TestCase +@@ -515,7 +525,7 @@ class Framework_Utils extends PHPUnit\Framework\TestCase ]; foreach ($input as $idx => $value) { @@ -10361,7 +10361,7 @@ } $input = [ -@@ -506,7 +516,7 @@ class Framework_Utils extends PHPUnit\Framework\TestCase +@@ -523,7 +533,7 @@ class Framework_Utils extends PHPUnit\Framework\TestCase ]; foreach ($input as $idx => $value) { @@ -10370,7 +10370,7 @@ } } -@@ -516,13 +526,13 @@ class Framework_Utils extends PHPUnit\Framework\TestCase +@@ -533,13 +543,13 @@ class Framework_Utils extends PHPUnit\Framework\TestCase function test_get_input_string() { $_GET = []; @@ -10387,7 +10387,7 @@ } /** -@@ -530,18 +540,18 @@ class Framework_Utils extends PHPUnit\Framework\TestCase +@@ -547,18 +557,18 @@ class Framework_Utils extends PHPUnit\Framework\TestCase */ function test_is_simple_string() { @@ -10418,7 +10418,7 @@ } /** -@@ -556,7 +566,7 @@ class Framework_Utils extends PHPUnit\Framework\TestCase +@@ -573,7 +583,7 @@ class Framework_Utils extends PHPUnit\Framework\TestCase ]; foreach ($test as $v) { @@ -10427,7 +10427,7 @@ $this->assertSame($v[2], $result); } } -@@ -646,7 +656,7 @@ class Framework_Utils extends PHPUnit\Framework\TestCase +@@ -668,7 +678,7 @@ class Framework_Utils extends PHPUnit\Framework\TestCase ]; foreach ($test as $datetime => $ts) { @@ -10436,7 +10436,7 @@ $this->assertSame($ts, $result, "Error parsing date: $datetime"); } } -@@ -673,7 +683,7 @@ class Framework_Utils extends PHPUnit\Framework\TestCase +@@ -695,7 +705,7 @@ class Framework_Utils extends PHPUnit\Framework\TestCase ]; foreach ($test as $datetime => $ts) { @@ -10445,7 +10445,7 @@ $this->assertSame($ts, $result ? $result->format('Y-m-d') : false, "Error parsing date: $datetime"); } -@@ -683,7 +693,7 @@ class Framework_Utils extends PHPUnit\Framework\TestCase +@@ -705,7 +715,7 @@ class Framework_Utils extends PHPUnit\Framework\TestCase ]; foreach ($test as $datetime => $ts) { @@ -10454,7 +10454,7 @@ $this->assertSame($ts, $result ? $result->format('Y-m-d H:i:s') : false, "Error parsing date: $datetime"); } -@@ -692,7 +702,7 @@ class Framework_Utils extends PHPUnit\Framework\TestCase +@@ -714,7 +724,7 @@ class Framework_Utils extends PHPUnit\Framework\TestCase ]; foreach ($test as $datetime => $ts) { @@ -10463,7 +10463,7 @@ $this->assertSame($ts, $result ? $result->format('Y-m-d H:i:s O') : false, "Error parsing date: $datetime"); } } -@@ -702,17 +712,17 @@ class Framework_Utils extends PHPUnit\Framework\TestCase +@@ -724,17 +734,17 @@ class Framework_Utils extends PHPUnit\Framework\TestCase */ function test_anytodatetime_timezone() { @@ -10484,7 +10484,7 @@ if ($result) $result->setTimezone($tz); // move to target timezone for comparison $this->assertSame($ts, $result ? $result->format('Y-m-d H:i') : false, "Error parsing date: $datetime"); } -@@ -731,7 +741,7 @@ class Framework_Utils extends PHPUnit\Framework\TestCase +@@ -753,7 +763,7 @@ class Framework_Utils extends PHPUnit\Framework\TestCase ]; foreach ($test as $data) { @@ -10493,7 +10493,7 @@ $this->assertSame($data[2], $result, "Error formatting date: " . $data[0]); } } -@@ -750,7 +760,7 @@ class Framework_Utils extends PHPUnit\Framework\TestCase +@@ -772,7 +782,7 @@ class Framework_Utils extends PHPUnit\Framework\TestCase ]; foreach ($test as $input => $output) { @@ -10502,7 +10502,7 @@ $this->assertSame($output, $result); } } -@@ -775,7 +785,7 @@ class Framework_Utils extends PHPUnit\Framework\TestCase +@@ -797,7 +807,7 @@ class Framework_Utils extends PHPUnit\Framework\TestCase ]; foreach ($test as $input => $output) { @@ -10511,7 +10511,7 @@ $this->assertSame($output, $result, "Error normalizing '$input'"); } } -@@ -798,7 +808,7 @@ class Framework_Utils extends PHPUnit\Framework\TestCase +@@ -820,7 +830,7 @@ class Framework_Utils extends PHPUnit\Framework\TestCase ]; foreach ($test as $idx => $params) { @@ -10520,7 +10520,7 @@ $this->assertSame($params[2], $result, "words_match() at index $idx"); } } -@@ -824,7 +834,7 @@ class Framework_Utils extends PHPUnit\Framework\TestCase +@@ -846,7 +856,7 @@ class Framework_Utils extends PHPUnit\Framework\TestCase } foreach ($test as $input => $output) { @@ -10529,7 +10529,7 @@ $this->assertSame($output, $result); } } -@@ -834,17 +844,17 @@ class Framework_Utils extends PHPUnit\Framework\TestCase +@@ -856,17 +866,17 @@ class Framework_Utils extends PHPUnit\Framework\TestCase */ function test_random_bytes() { @@ -10553,7 +10553,7 @@ { /* -@@ -881,9 +891,10 @@ class Framework_Utils extends PHPUnit\Framework\TestCase +@@ -903,9 +913,10 @@ class Framework_Utils extends PHPUnit\Framework\TestCase * @param string $encoded Encoded email address * @dataProvider data_idn_convert */ @@ -10565,7 +10565,7 @@ } /** -@@ -893,9 +904,10 @@ class Framework_Utils extends PHPUnit\Framework\TestCase +@@ -915,9 +926,10 @@ class Framework_Utils extends PHPUnit\Framework\TestCase * @param string $encoded Encoded email address * @dataProvider data_idn_convert */ @@ -10577,7 +10577,7 @@ } /** -@@ -903,14 +915,14 @@ class Framework_Utils extends PHPUnit\Framework\TestCase +@@ -925,14 +937,14 @@ class Framework_Utils extends PHPUnit\Framework\TestCase */ function test_idn_to_ascii_special() { @@ -10595,7 +10595,7 @@ { return [ ['%z', 'hostname', 'hostname'], -@@ -925,15 +937,16 @@ class Framework_Utils extends PHPUnit\Framework\TestCase +@@ -947,15 +959,16 @@ class Framework_Utils extends PHPUnit\Framework\TestCase * * @dataProvider data_parse_host */ @@ -10614,7 +10614,7 @@ { return [ [['hostname', null, null], ['hostname', null, null]], -@@ -956,15 +969,16 @@ class Framework_Utils extends PHPUnit\Framework\TestCase +@@ -978,15 +991,16 @@ class Framework_Utils extends PHPUnit\Framework\TestCase * * @dataProvider data_parse_host_uri */ @@ -10633,7 +10633,7 @@ return [ ['both', 'Fwd: Re: Test subject both', 'Test subject both'], ['both', 'Re: Fwd: Test subject both', 'Test subject both'], -@@ -982,8 +996,9 @@ class Framework_Utils extends PHPUnit\Framework\TestCase +@@ -1004,8 +1018,9 @@ class Framework_Utils extends PHPUnit\Framework\TestCase * * @dataProvider data_remove_subject_prefix */ @@ -10644,7 +10644,7 @@ } /** -@@ -991,13 +1006,13 @@ class Framework_Utils extends PHPUnit\Framework\TestCase +@@ -1013,13 +1028,13 @@ class Framework_Utils extends PHPUnit\Framework\TestCase */ function test_server_name() { @@ -10661,7 +10661,7 @@ } /** -@@ -1007,31 +1022,31 @@ class Framework_Utils extends PHPUnit\Framework\TestCase +@@ -1029,31 +1044,31 @@ class Framework_Utils extends PHPUnit\Framework\TestCase { $_SERVER['test'] = 'test.com'; @@ -10860,7 +10860,7 @@ $this->assertSame($result, "BEGIN:VCARD\r\nVERSION:3.0\r\nFN:\r\nN:;;;;\r\nEND:VCARD"); diff --git a/tests/Framework/Washtml.php b/tests/Framework/Washtml.php -index 03ab2db..a61f7da 100644 +index 794a077..85cbe9b 100644 --- a/tests/Framework/Washtml.php +++ b/tests/Framework/Washtml.php @@ -1,11 +1,14 @@ @@ -11061,7 +11061,7 @@ { $svg1 = ""; -@@ -573,9 +576,10 @@ class Framework_Washtml extends PHPUnit\Framework\TestCase +@@ -622,9 +625,10 @@ class Framework_Washtml extends PHPUnit\Framework\TestCase * * @dataProvider data_wash_svg_tests */ @@ -11073,7 +11073,7 @@ $washed = $washer->wash($input); $this->assertSame($expected, $this->cleanupResult($washed), "SVG content"); -@@ -584,7 +588,7 @@ class Framework_Washtml extends PHPUnit\Framework\TestCase +@@ -633,7 +637,7 @@ class Framework_Washtml extends PHPUnit\Framework\TestCase /** * Test cases for various XSS issues */ @@ -11082,7 +11082,7 @@ { return [ [ -@@ -660,9 +664,10 @@ class Framework_Washtml extends PHPUnit\Framework\TestCase +@@ -709,9 +713,10 @@ class Framework_Washtml extends PHPUnit\Framework\TestCase * * @dataProvider data_wash_xss_tests */ @@ -11094,7 +11094,7 @@ $washed = $washer->wash($input); $this->assertSame($expected, $this->cleanupResult($washed), "XSS issues"); -@@ -676,7 +681,7 @@ class Framework_Washtml extends PHPUnit\Framework\TestCase +@@ -725,7 +730,7 @@ class Framework_Washtml extends PHPUnit\Framework\TestCase $html = ""; $exp = ""; @@ -11103,7 +11103,7 @@ $washed = $washer->wash($html); $this->assertTrue(strpos($washed, $exp) !== false, "Position:fixed (#5264)"); -@@ -720,7 +725,7 @@ class Framework_Washtml extends PHPUnit\Framework\TestCase +@@ -769,7 +774,7 @@ class Framework_Washtml extends PHPUnit\Framework\TestCase I_D = \frac{1}{2} k_n \frac{W}{L} (V_{GS}-V_t)^2 '; @@ -11112,7 +11112,7 @@ $washed = $washer->wash($mathml); // remove whitespace between tags -@@ -737,7 +742,7 @@ class Framework_Washtml extends PHPUnit\Framework\TestCase +@@ -786,7 +791,7 @@ class Framework_Washtml extends PHPUnit\Framework\TestCase { $html = ""; @@ -11121,7 +11121,7 @@ $washed = $washer->wash($html); $this->assertTrue($washer->extlinks); -@@ -745,7 +750,7 @@ class Framework_Washtml extends PHPUnit\Framework\TestCase +@@ -794,7 +799,7 @@ class Framework_Washtml extends PHPUnit\Framework\TestCase $html = "