[Pkg-roundcube-maintainers] roundcube_1.6.20+dfsg-0+deb13u1_source.changes ACCEPTED into proposed-updates->stable-new

[Debian FTP Masters]

Thank you for your contribution to Debian.

Mapping stable-security to proposed-updates.

Accepted:

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Tue, 20 Oct 2026 07:00:29 +0200
Source: roundcube
Architecture: source
Version: 1.6.20+dfsg-0+deb13u1
Distribution: trixie-security
Urgency: high
Maintainer: Debian Roundcube Maintainers <pkg-roundcube-maintainers at alioth-lists.debian.net>
Changed-By: Guilhem Moulin <guilhem at debian.org>
Closes: 1151279
Changes:
 roundcube (1.6.20+dfsg-0+deb13u1) trixie-security; urgency=high
 .
   * New upstream security and bugfix release (closes: #1151279).
     + Fix CVE-2026-113386: IMAP command injection via CRLF in `_uid` parameter
       of mail/headers and mail/viewsource action.
     + Fix bug where an alias login wasn't qualified by IMAP host.
     + Add a size limit to the CSS proxy content processing.
     + Fix SSRF filter (`is_local_url()`) bypass via NAT64 64:ff9b::/96.
     + Fix remote content blocking bypass via SVG SMIL `by` attribute.
     + Fix remote content blocking bypass via CSS escapes in FuncIRI attributes
       (again).
     + Fix passing potentially unsafe attachment content into ImageMagick on
       image resize.
     + Fix mail header injection via the From display-name in the Bounce (resend)
       action.
     + Fix mail header injection via References/In-Reply-To/Message-ID/From
       parameters.
     + Fix object injection primitive in rcube_session::unserialize() via
       “!”-prefixed session keys.
     + Fix ImageMagick resource limits bypass by GD fallback during thumbnail
       generation.
     + Fix CSS scoping bypass in HTML messages using at-rules.
     + Fix bug where deprecated action aliases bypassed `disabled_actions`
       setting.
     + Fix IMAP command injection via CRLF in `_flag` parameter of mail/mark
       action.
     + Fix CSRF validation bypass in the mark-as-junk action.
     + Fix XSS issue in handling of password driver error responses.
     + Fix mail header injection via subject of a message forwarded as
       attachment.
     + Fix mail header injection via media type in an inline image data URI.
     + Fix bug where Password Modoboa driver could change password for another
       account.
     + Fix unsafe use of a login name in SquirrelMail import file path.
   * Refresh d/patches.
Checksums-Sha1:
 a0a03bd91aa0a453fce1b0fe81640b2e3e991ee0 3860 roundcube_1.6.20+dfsg-0+deb13u1.dsc
 32a740c50ee6ae83c79d675e539d9bb4ff86ca19 126856 roundcube_1.6.20+dfsg.orig-tinymce-langs.tar.xz
 c17351cead238baa4a63bce2b136ff054c2034f9 1928744 roundcube_1.6.20+dfsg.orig-tinymce.tar.xz
 d6cb3e64e6cef16458b627130240c0e7e88b7536 2921204 roundcube_1.6.20+dfsg.orig.tar.xz
 edd75d5f492f832d17bc7651d442b81b18b7c0e4 159268 roundcube_1.6.20+dfsg-0+deb13u1.debian.tar.xz
 3e6098a85573a04218818f1003cc7dcc40fb39ac 6734 roundcube_1.6.20+dfsg-0+deb13u1_source.buildinfo
Checksums-Sha256:
 9e5652f65efed5c66c87c929b71c4e423866e49dcee0ed69a9810b669b020fa1 3860 roundcube_1.6.20+dfsg-0+deb13u1.dsc
 b7968a5dd8a32fdbde4afd733111a6fd44cbfa346332bd07e4dcf2c5b09007cf 126856 roundcube_1.6.20+dfsg.orig-tinymce-langs.tar.xz
 5f0d2f90355cd16d94d6be3e857995be0c4bad6b96cde894815901577eba5c34 1928744 roundcube_1.6.20+dfsg.orig-tinymce.tar.xz
 fa1b308c9e3169776321b80af6f1831329b1947a515a024fe9032e31055c3b39 2921204 roundcube_1.6.20+dfsg.orig.tar.xz
 ebcd742800aff6baed866d2fd2b71a7b078e92b0ab0d9ea260df3bdef0e6dd18 159268 roundcube_1.6.20+dfsg-0+deb13u1.debian.tar.xz
 e753bd947e230d50d76f7d805381f88db5d4ac2dae1e21084d90787cc33dbf3e 6734 roundcube_1.6.20+dfsg-0+deb13u1_source.buildinfo
Files:
 133edf32ba197c0740e7581a99b8c77c 3860 web optional roundcube_1.6.20+dfsg-0+deb13u1.dsc
 9f448ec4c449b2c7a9af1544112ef559 126856 web optional roundcube_1.6.20+dfsg.orig-tinymce-langs.tar.xz
 c7276aef6d00b70deda0abf66bc2e050 1928744 web optional roundcube_1.6.20+dfsg.orig-tinymce.tar.xz
 a7ab89080eb8e14bc5433bbd30b05120 2921204 web optional roundcube_1.6.20+dfsg.orig.tar.xz
 6f9acb638292ccedde2dfbf78a7caa2c 159268 web optional roundcube_1.6.20+dfsg-0+deb13u1.debian.tar.xz
 7dbfcd846cd83138e547acf750a386af 6734 web optional roundcube_1.6.20+dfsg-0+deb13u1_source.buildinfo

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEERpy6p3b9sfzUdbME05pJnDwhpVIFAmrYeC8ACgkQ05pJnDwh
pVLusw/9E0/NKOnaOak79G+0fdJgXf/LTK6mMNRwoxqOlmMonSCa2qQdwu2pdN18
XRfGtRloDkQdb4MKoDmTRQ87imp/4TkLyCxbvs+bhwoS/y9U37HQXn0rFuSBxlzV
ciEw2mUuHl4t3sWknEhcTHTDYk6XwObaTBsM7XMieyMxVsBYuYAQRAC8fv3JXWH7
gHTU+5Xe8M90xYwl912uDtGqBPDq1nFLww0n60LmriRQtRoghmIjMivtB7N96Ybh
zRlOCue71bQsdmYj/3SCumBaIZMlKwTfd8kZ0Rpfw2kqDtlvU4Ko4p9wU6ot9ery
ii92r6GWQxRY+CWHjyB582UqvsAB4cSC/4SCAXCikwlUE200eU7oxMOxMyN47hQP
1ixlu4sQjYv34JaSLgFfvWZxQHIsCVFRN3bcW+PMBB5FF52ITC4HcUoO2T4eESC2
+YRIAbdqvlaWd2ACFmM+zxPnEBTEEZesH3nSQ9ENGYfffto4+vOHUOzF+y7HZ6n8
TCRRJogPL1XemBAO1gCUSr0fljfRTytJrO5fkP6uCdc4ZNA1T0pzzMA5FjEa9JD1
aooWBL3URQugJpodIAh/SIX8zOi6gG/a29o11mD+nqulJuoRNjPwNbnhh9GHOAdz
Wljk9P/JqkA/Z8ViuqBUh2sW7SAsfrhC4HbOF4i+Lw06E/R0eOs=
=YPW2
-----END PGP SIGNATURE-----

-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 228 bytes
Desc: not available
URL: <http://alioth-lists.debian.net/pipermail/pkg-roundcube-maintainers/attachments/20261023/bc74eaff/attachment.sig>