[Pkg-roundcube-maintainers] roundcube_1.6.19+dfsg-0+deb13u1_source.changes ACCEPTED into proposed-updates->stable-new

[Debian FTP Masters]

Thank you for your contribution to Debian.

Mapping stable-security to proposed-updates.

Accepted:

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Sun, 06 Sep 2026 13:22:41 +0200
Source: roundcube
Architecture: source
Version: 1.6.19+dfsg-0+deb13u1
Distribution: trixie-security
Urgency: high
Maintainer: Debian Roundcube Maintainers <pkg-roundcube-maintainers at alioth-lists.debian.net>
Changed-By: Guilhem Moulin <guilhem at debian.org>
Closes: 1146838
Changes:
 roundcube (1.6.19+dfsg-0+deb13u1) trixie-security; urgency=high
 .
   * New upstream security and bugfix release (closes: #1146838).
     + Fix CSS declaration smuggling via un-encoded ampersand emission.
     + Fix CSS property injection via body `background` attribute.
     + Fix email header injection via bare CR in the subject field.
     + Fix email header injection via C-escape `\r` in the recipient display
       name.
     + Fix email header injection via identity's organization field.
     + Fix zero-click stored XSS via TNEF MIME tag injection in the attachment
       URL.
     + Fix XSS in the HTML editor using text/enriched part content.
     + Fix cross-user access in contact group membership (add/remove) in the
       SQL address book.
     + Fix `is_local_url()` bypass via trailing-dot FQDN in stylesheet URL.
     + Fix remote content blocking bypass via CSS escapes in FuncIRI
       attributes.
     + Fix remote-content blocker bypass via SVG SMIL src animation.
   * Refresh d/patches and remove those applied upstream.
Checksums-Sha1:
 abf62dd6b4459360ffeebfdb534b34f991e26857 3860 roundcube_1.6.19+dfsg-0+deb13u1.dsc
 42a4a432e26557e1f256016fd70522a3e5fc7dd8 126884 roundcube_1.6.19+dfsg.orig-tinymce-langs.tar.xz
 f181c2ba04cea59621711962e3553c53e9d9882a 1928432 roundcube_1.6.19+dfsg.orig-tinymce.tar.xz
 8c7c229d2ba194dc8dfb1874efb9b1401a786ff1 2910024 roundcube_1.6.19+dfsg.orig.tar.xz
 51af771a0b18501a16527b46ca2e1fc06816fc89 158696 roundcube_1.6.19+dfsg-0+deb13u1.debian.tar.xz
 e1a03051a51563b0d244aa009a19c4f4168ad7df 6633 roundcube_1.6.19+dfsg-0+deb13u1_source.buildinfo
Checksums-Sha256:
 9e4fc3d1153b54397d74fd0ea4edbe6c3b18ea6f947885ecc004bf85ab5b7e13 3860 roundcube_1.6.19+dfsg-0+deb13u1.dsc
 83b2d0ee3e4d937f86d1a8db01deed4c18c1d097a964a3134f9c0748c6eb0dfb 126884 roundcube_1.6.19+dfsg.orig-tinymce-langs.tar.xz
 d6a37e1987aa5c3b027f916f18ebbb778c38ee3e0cdf236ee88725ab07cdd6f9 1928432 roundcube_1.6.19+dfsg.orig-tinymce.tar.xz
 10e6ffaeae68f5aa3d7c41fe5e5c29ca37df500ced8a2b75a0fae66f190050f1 2910024 roundcube_1.6.19+dfsg.orig.tar.xz
 a3de3cdfe507885459cfce4932b5b6ff1a213af54119d50ae7bc3219db64d6e5 158696 roundcube_1.6.19+dfsg-0+deb13u1.debian.tar.xz
 46c42ca65a13c105099d70972a23a7fdc6b282541e2dff82d64c33d6cd6d0d8b 6633 roundcube_1.6.19+dfsg-0+deb13u1_source.buildinfo
Files:
 26adba7d4bf72a3d6ebcb8b118cad0b3 3860 web optional roundcube_1.6.19+dfsg-0+deb13u1.dsc
 8ac2d1ce8d0f3d2979ad98f17a3a5090 126884 web optional roundcube_1.6.19+dfsg.orig-tinymce-langs.tar.xz
 92283952d3baebc2b092c1298a7f4c0e 1928432 web optional roundcube_1.6.19+dfsg.orig-tinymce.tar.xz
 5d27f90436ad392e742590cc0918a18f 2910024 web optional roundcube_1.6.19+dfsg.orig.tar.xz
 20e2aac5f25eec65333982ce073acb66 158696 web optional roundcube_1.6.19+dfsg-0+deb13u1.debian.tar.xz
 dc22a9f63813ddaafe25d59fc20f8178 6633 web optional roundcube_1.6.19+dfsg-0+deb13u1_source.buildinfo

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEERpy6p3b9sfzUdbME05pJnDwhpVIFAmrD94wACgkQ05pJnDwh
pVLa9g//VZBBNRaQINXz9/8PFXfjlENS72pmSiAnTotXsHsX/r6gQDV6HuOu+rUE
hgHT2V5ZJXe/CaQfLHodSBIjqf2SdDi/7xADyrsnqSc+Qq4V9on25YSj9J6pyRSA
PIixw7TE8a+K+SD9RNGTryXdBVOHBdxDLUA5bh1a2R2RcwswxRT4ozpAyKLm7T1Q
uhiP7X8gEHafJ9n58yzXS5iI1UrieZb1uhMP7oTpKhgufVgkOnv5o6ppGPMJejtW
gzoECHGrZoadtkGCM7+RzzjJccntQgoJ+XVeKeCMc5y41Vxm+7RnDzJy0IYpepp5
whUjUbYcHbNMj7s8t3+BNfMqc6Ukuf0H7IV0iWuJ0aYcWgsKIYKMKQ33u8xInGBw
hS1f2G0I2PLslIv00AVZsR0ba4goEH/FsydCxboFU4IfI1PsdhFrBdH/g16OBLx5
5+gMxGxjyyzN1I3BTHvZ4VXrbvlmd/60nflIt/EOPA1nte177guhKtcnHrVkV+6X
J2Yf9xH+gzqtfy3wIFlS6IeFTmZBdzgpFQ/8V1mVoOU/wks7XAV1bc6jAFXY5a2s
Th9uNYVb+I+me9fEoEDIKoqo3SQYM5h4RmBwzP96LQ5AlFzXVhX0Tyuur2ZbKis9
tJ5H4vz8+b6HlAMvsP8NsDuIhqRrxx0D3yOr1tbTibH1Bug4GdE=
=K6yv
-----END PGP SIGNATURE-----

-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 228 bytes
Desc: not available
URL: <http://alioth-lists.debian.net/pipermail/pkg-roundcube-maintainers/attachments/20261006/32680e89/attachment.sig>