[Pkg-roundcube-maintainers] roundcube_1.6.20+dfsg-1_source.changes ACCEPTED into unstable

[Debian FTP Masters]

Thank you for your contribution to Debian.



Accepted:

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Mon, 19 Oct 2026 16:51:01 +0200
Source: roundcube
Architecture: source
Version: 1.6.20+dfsg-1
Distribution: unstable
Urgency: medium
Maintainer: Debian Roundcube Maintainers <pkg-roundcube-maintainers at alioth-lists.debian.net>
Changed-By: Guilhem Moulin <guilhem at debian.org>
Closes: 1151279
Changes:
 roundcube (1.6.20+dfsg-1) unstable; urgency=medium
 .
   * New upstream security and bugfix release (closes: #1151279).
     + Fix IMAP command injection via CRLF in `_uid` parameter of mail/headers
       and mail/viewsource action.
     + Fix bug where an alias login wasn't qualified by IMAP host.
     + Add a size limit to the CSS proxy content processing.
     + Fix SSRF filter (is_local_url()) bypass via NAT64 64:ff9b::/96.
     + Fix remote content blocking bypass via SVG SMIL `by` attribute.
     + Fix remote content blocking bypass via CSS escapes in FuncIRI attributes
       (again).
     + Fix passing potentially unsafe attachment content into ImageMagick on
       image resize.
     + Fix mail header injection via the From display-name in the Bounce (resend)
       action.
     + Fix mail header injection via References/In-Reply-To/Message-ID/From
       parameters.
     + Fix object injection primitive in rcube_session::unserialize() via
       “!”-prefixed session keys.
     + Fix ImageMagick resource limits bypass by GD fallback during thumbnail
       generation.
     + Fix CSS scoping bypass in HTML messages using at-rules.
     + Fix bug where deprecated action aliases bypassed `disabled_actions`
       setting.
     + Fix IMAP command injection via CRLF in `_flag` parameter of mail/mark
       action.
     + Fix CSRF validation bypass in the mark-as-junk action.
     + Fix XSS issue in handling of password driver error responses.
     + Fix mail header injection via subject of a message forwarded as
       attachment.
     + Fix mail header injection via media type in an inline image data URI.
     + Fix bug where Password Modoboa driver could change password for another
       account.
     + Fix unsafe use of a login name in SquirrelMail import file path.
   * Remove `Depends: ${misc:Depends}` from the binary packages.
   * Refresh d/roundcube-core.lintian-overrides.
Checksums-Sha1:
 15788fa9018782f7800dd4e7c280a22f82d2f4cf 3845 roundcube_1.6.20+dfsg-1.dsc
 32a740c50ee6ae83c79d675e539d9bb4ff86ca19 126856 roundcube_1.6.20+dfsg.orig-tinymce-langs.tar.xz
 c17351cead238baa4a63bce2b136ff054c2034f9 1928744 roundcube_1.6.20+dfsg.orig-tinymce.tar.xz
 d6cb3e64e6cef16458b627130240c0e7e88b7536 2921204 roundcube_1.6.20+dfsg.orig.tar.xz
 12748f310f554dda71c7ff9eb85ee3c8fd57c223 160736 roundcube_1.6.20+dfsg-1.debian.tar.xz
 d5074c57b5ce2b37285b8d638a43fac0b0679d71 6606 roundcube_1.6.20+dfsg-1_source.buildinfo
Checksums-Sha256:
 ad49d6e2c5b2456fd1181965d6e2d95b791550fb1fd49f5a8594c5b7db0f0286 3845 roundcube_1.6.20+dfsg-1.dsc
 b7968a5dd8a32fdbde4afd733111a6fd44cbfa346332bd07e4dcf2c5b09007cf 126856 roundcube_1.6.20+dfsg.orig-tinymce-langs.tar.xz
 5f0d2f90355cd16d94d6be3e857995be0c4bad6b96cde894815901577eba5c34 1928744 roundcube_1.6.20+dfsg.orig-tinymce.tar.xz
 fa1b308c9e3169776321b80af6f1831329b1947a515a024fe9032e31055c3b39 2921204 roundcube_1.6.20+dfsg.orig.tar.xz
 67eb7e731cd90162e0c4e094c6479ffc58c78b3482452c50e7ed194a5e957b7f 160736 roundcube_1.6.20+dfsg-1.debian.tar.xz
 9983c4c0dceb08ac00793e7647c0260c2d85681693ad48f776404b6bde523e44 6606 roundcube_1.6.20+dfsg-1_source.buildinfo
Files:
 2b50841dc93f7b8d5f4e129b8816c61c 3845 web optional roundcube_1.6.20+dfsg-1.dsc
 9f448ec4c449b2c7a9af1544112ef559 126856 web optional roundcube_1.6.20+dfsg.orig-tinymce-langs.tar.xz
 c7276aef6d00b70deda0abf66bc2e050 1928744 web optional roundcube_1.6.20+dfsg.orig-tinymce.tar.xz
 a7ab89080eb8e14bc5433bbd30b05120 2921204 web optional roundcube_1.6.20+dfsg.orig.tar.xz
 4b02718efe18e2ffffbe2193f630da79 160736 web optional roundcube_1.6.20+dfsg-1.debian.tar.xz
 c94235c8487a69860e3762d710f6a96e 6606 web optional roundcube_1.6.20+dfsg-1_source.buildinfo

-----BEGIN PGP SIGNATURE-----

iQIyBAEBCgAdFiEERpy6p3b9sfzUdbME05pJnDwhpVIFAmrWPoEACgkQ05pJnDwh
pVI7Ug/4zojdCk8ECAJ0ebvX7Rq6bCzGvUF/05TZnw+VlFnTrDnB1lUrR4eK8SPG
Fn+6Vg8DzyqFdl5wsb4QGCdjGhzKdOOGW9QifKa2lbkN6fGbYIM4Q8CEDMr3jn1g
aUbYzl94LA1MBdpr+SZrq1U8TpnR2r9NHvP7OckqRR8gN7SjdS37PiH36+8DsC5I
58YQm4jgH1NekIBRlFbysicyuHJMqe3KbEI1rZQ+s2QS0fDFyokfond9PGj1CP9e
J7pH5/0yU2OJS0Yw1GErqbt7Z1rW4hNXCujmSORT2UYQ2sAuKX3SdKbvvUQMPZZN
l68u9T06OjDxEZQVVRucRQkUDROp4t98vA6r+uVnHlfOV4L0NwpKyIYdhc5i64j4
Ph8Z7ViDgn022QbZNfaX9sWEUO7du/lPU03eFBjYKXU74UdDEvlZp5HE280W/uJd
lUaWveT1dpMRo4SiLRDbelVSfvbzeguc2el7UKMpIj7H/vk2txyMY5AKz/FboQEE
E5YxkUJ+ncuc4qPzQsgenYbbcpUjXG3O+a3/PbRJn99gKrxIiGY9T4r+KRdxBbAd
L7zvBcaEDIzWlwPlwlYbtHreMizCd2glmivDQPtAIOXblUoq3m1frpS0Gm+Tubwm
bgTalwF5Zfh9ktQxGpc/5WTxcd4wITSGkpwxHkZq0oPmgvo8/A==
=eGBZ
-----END PGP SIGNATURE-----

-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 228 bytes
Desc: not available
URL: <http://alioth-lists.debian.net/pipermail/pkg-roundcube-maintainers/attachments/20261019/0c2e4f7b/attachment.sig>