[Pkg-roundcube-maintainers] Bug#1151279: roundcube: Multiple security vulnerabilities

[Guilhem Moulin]

Hi,

On Mon, 19 Oct 2026 at 16:22:07 +0200, Guilhem Moulin wrote:
> Roundcube webmail upstream has just released 1.6.20 [0] which fixes a
> new batch of security vulnerabilities:

As for the previous uploads, I suggest to follow 1.6.x (upstream's
current LTS release) for trixie-security.  The upstream diff [0] is
targeted anyway.  Several of the issues, in particular the SSRF, XSS and
remote-content blocker bypass, have test coverage.

Tested debdiff attached.  Debusine result:
https://debusine.debian.net/debian/developers/work-request/1508582/

Cheers,
-- 
Guilhem.

[0] https://github.com/roundcube/roundcubemail/compare/1.6.19...1.6.20
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: not available
URL: <http://alioth-lists.debian.net/pipermail/pkg-roundcube-maintainers/attachments/20261021/264d1bea/attachment.sig>