[Pkg-roundcube-maintainers] roundcube_1.6.19+dfsg-1_source.changes ACCEPTED into unstable

[Debian FTP Masters]

Thank you for your contribution to Debian.



Accepted:

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Sun, 06 Sep 2026 11:50:58 +0200
Source: roundcube
Architecture: source
Version: 1.6.19+dfsg-1
Distribution: unstable
Urgency: medium
Maintainer: Debian Roundcube Maintainers <pkg-roundcube-maintainers at alioth-lists.debian.net>
Changed-By: Guilhem Moulin <guilhem at debian.org>
Closes: 1146838
Changes:
 roundcube (1.6.19+dfsg-1) unstable; urgency=medium
 .
   * New upstream security and bugfix release (closes: #1146838).
     + Fix CSS declaration smuggling via un-encoded ampersand emission.
     + Fix CSS property injection via body `background` attribute.
     + Fix email header injection via bare CR in the subject field.
     + Fix email header injection via C-escape `\r` in the recipient display
       name.
     + Fix email header injection via identity's organization field.
     + Fix zero-click stored XSS via TNEF MIME tag injection in the attachment
       URL.
     + Fix XSS in the HTML editor using text/enriched part content.
     + Fix cross-user access in contact group membership (add/remove) in the
       SQL address book.
     + Fix `is_local_url()` bypass via trailing-dot FQDN in stylesheet URL.
     + Fix remote content blocking bypass via CSS escapes in FuncIRI
       attributes.
     + Fix remote-content blocker bypass via SVG SMIL src animation.
   * Refresh d/patches and remove those applied upstream.
   * Bump debhelper compatibility level to 14 (no changes necessary).
Checksums-Sha1:
 464ea642b1482891a047cb17bf7ad34bc0a8f65e 3845 roundcube_1.6.19+dfsg-1.dsc
 42a4a432e26557e1f256016fd70522a3e5fc7dd8 126884 roundcube_1.6.19+dfsg.orig-tinymce-langs.tar.xz
 f181c2ba04cea59621711962e3553c53e9d9882a 1928432 roundcube_1.6.19+dfsg.orig-tinymce.tar.xz
 8c7c229d2ba194dc8dfb1874efb9b1401a786ff1 2910024 roundcube_1.6.19+dfsg.orig.tar.xz
 13d4f75ad1ed1be248c372759322d1acb44129fb 160184 roundcube_1.6.19+dfsg-1.debian.tar.xz
 4589269843b69e0358f7e4d288a3af88104677a5 6646 roundcube_1.6.19+dfsg-1_source.buildinfo
Checksums-Sha256:
 74d6d446c376cc65a1dd2568b0c10a0b4c29a067de5e6d44fff3d7212027ad19 3845 roundcube_1.6.19+dfsg-1.dsc
 83b2d0ee3e4d937f86d1a8db01deed4c18c1d097a964a3134f9c0748c6eb0dfb 126884 roundcube_1.6.19+dfsg.orig-tinymce-langs.tar.xz
 d6a37e1987aa5c3b027f916f18ebbb778c38ee3e0cdf236ee88725ab07cdd6f9 1928432 roundcube_1.6.19+dfsg.orig-tinymce.tar.xz
 10e6ffaeae68f5aa3d7c41fe5e5c29ca37df500ced8a2b75a0fae66f190050f1 2910024 roundcube_1.6.19+dfsg.orig.tar.xz
 dff5dc5c08ffb9539ce790f88523aefc37e2633b29479f19bc4e2ba879bcd71c 160184 roundcube_1.6.19+dfsg-1.debian.tar.xz
 2be1fb55aa99c12b8aaaa7901caaeea0aa46a8f72419f040d48c23c180309c08 6646 roundcube_1.6.19+dfsg-1_source.buildinfo
Files:
 e8a71b2daab60f2093d8500cc2a8dd4c 3845 web optional roundcube_1.6.19+dfsg-1.dsc
 8ac2d1ce8d0f3d2979ad98f17a3a5090 126884 web optional roundcube_1.6.19+dfsg.orig-tinymce-langs.tar.xz
 92283952d3baebc2b092c1298a7f4c0e 1928432 web optional roundcube_1.6.19+dfsg.orig-tinymce.tar.xz
 5d27f90436ad392e742590cc0918a18f 2910024 web optional roundcube_1.6.19+dfsg.orig.tar.xz
 95be6ab5708eb4063762df025f170946 160184 web optional roundcube_1.6.19+dfsg-1.debian.tar.xz
 f6fe37aeb331940fd911fd7282815968 6646 web optional roundcube_1.6.19+dfsg-1_source.buildinfo

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEERpy6p3b9sfzUdbME05pJnDwhpVIFAmqdfiEACgkQ05pJnDwh
pVIXJA/+OEefeNc1YypThImPpB9OZ7JBqSTOEC9qTZz8Le+ZjzUGFcJcWbls2/NO
vjAiAq8YCJH7ntbChka6IkEyiiRho2o8e6YTsjdw2TmFKhRrv+65i9Ja9MxoiXua
33uxpdJjSq2+4MlpY+rTuZ8iND8HQk3QtpeAD+7kdyRpmO4Y97gHB/Osovg0YGls
TSgKpVvr7REpgcBWaee0tcehMGWuM4x7uKmaQTMiC5qdUgntylsbG+XBQRPXOy4o
Kt49JdfD7HSM1Us3F74+rPnsWrAlAl5gIOh2VcW2Kqc3iz4HCCJfOpnoNj52Zffg
WZzQxdtW1EP5nH4qk8k4Q94K6e7OVVjc/IdZvJQnfWp2sTD0FqdAfb+BiF5msAK9
agtYJNWfAtWSaJQ99+YByFIeYAWkJjmqKQGirzFMAm11RSotEvKLWPyHSMTCbAmw
ThzmqMG9HcaDsTNymAxeKil35oS9SRJs5pOeN0cJKTqPvyLnAaVSiOiUQhDvGbS3
SGBsmxyqdESROFqehdPqFEWQPCGDiMlazw5GCVYUhI2zjTKpyfoJcQl4cpsY+gSX
ccAImUKzrge0KByJKPVZsSl57U8xs+rzQt3sETmZnK0PSPMW24bB6MvJjSXpulOZ
BPobTNP27sxpSc0p1I0YkKO+kED73kqlZb6yE1VNSMlWbSf1e0E=
=NMMt
-----END PGP SIGNATURE-----

-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 228 bytes
Desc: not available
URL: <http://alioth-lists.debian.net/pipermail/pkg-roundcube-maintainers/attachments/20260906/e9ef2ff0/attachment-0001.sig>