-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Sat, 04 Dec 2021 14:34:59 +0100 Source: roundcube Architecture: source Version: 1.4.12+dfsg.1-1~bpo10+1 Distribution: buster-backports Urgency: high Maintainer: Debian Roundcube Maintainers <pkg-roundcube-maintainers@alioth-lists.debian.net> Changed-By: Guilhem Moulin <guilhem@debian.org> Closes: 1000156 Changes: roundcube (1.4.12+dfsg.1-1~bpo10+1) buster-backports; urgency=medium . * Rebuild for buster-backports. . roundcube (1.4.12+dfsg.1-1~deb11u1) bullseye-security; urgency=high . * New bugfix/security upstream release (closes: #1000156), with fixes for: + CVE-2021-44025: XSS issue in handling attachment filename extension in mimetype mismatch warning; and + CVE-2021-44026: possible SQL injection via some session variables. * d/gbp.conf: Rename upstream branch to upstream/release-1.4. * d/salsa-ci.yml: Set RELEASE=bullseye. * Refresh d/patches. Checksums-Sha1: 64425cc1e6571b3e84f3246f60751e6716d47d14 3273 roundcube_1.4.12+dfsg.1-1~bpo10+1.dsc 48500aadc54a2d1afa0489c39d06c83a3474981f 91576 roundcube_1.4.12+dfsg.1-1~bpo10+1.debian.tar.xz 7b06760155b5e57e80bd1e4f01fc46ade670270b 14533 roundcube_1.4.12+dfsg.1-1~bpo10+1_amd64.buildinfo Checksums-Sha256: 56891139ec100c72af33e6b49d42d5ca63aa2b824566748139de2393ab6e911c 3273 roundcube_1.4.12+dfsg.1-1~bpo10+1.dsc 915c6bfe63fdf804d6be732103412e17f7cb84cffa2fafb951d43d96a5a607e1 91576 roundcube_1.4.12+dfsg.1-1~bpo10+1.debian.tar.xz 1d15df9eb95264bdf8e1f13d6db49bbaf89472c6946859999f016c9cf5304c18 14533 roundcube_1.4.12+dfsg.1-1~bpo10+1_amd64.buildinfo Files: b90ee38a91d70ab0c58bad9aef9588a0 3273 web optional roundcube_1.4.12+dfsg.1-1~bpo10+1.dsc ad51c572074fa22f6738eea670edd04b 91576 web optional roundcube_1.4.12+dfsg.1-1~bpo10+1.debian.tar.xz ca0ae310fa56e9dddc340229fbddbcf9 14533 web optional roundcube_1.4.12+dfsg.1-1~bpo10+1_amd64.buildinfo -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEERpy6p3b9sfzUdbME05pJnDwhpVIFAmGrcG0ACgkQ05pJnDwh pVKqXQ//QEQNCCHf91hBf/CK1m0l83w5uBF4imc5aNutGoATACSs6rf47UAKERoT CoLeP0GJ4dlUajPhTSjfUw0X85urKXLdTHf/VAu/7sHiV6Au4M3+T2UiBffNKwgS 2Hfv/MwgjUN57F4yqPkVnMPmnYORuQWVsdUVjcafsphUoCEzZzOgvYIx2hFq+bQW 6hudF4DV4QPOMTasvWbeuC8FRLZg3na/8vEF465iA2mbNVqv6oTLgguR+IMBnODY uyw605TYEXyhwmORiYLcIu85muYcVtF9uI5NnZEDAYPYJN6kvr6buNN7jAkfvHi+ YgVwGz9HXgki5lG2oMBof2RE42lZ9cQkvVZDZTja0FNbW+BE31CQhEibliG+jtqA pJfNxMnMKhA5z4awaKxUMWthKC0wNGgtVJq6YquP9p8Jzo030LjFIAPQlnSVcK5J +TZ0Jwl6RIFWQlaZF25WlzTlA/EUI1fBZX7pDrDq1qq3nFD/kpR/VA9hrE5iTvUv U8XT+DHvQUDsSU5s4084aUKIRIMXMNQ8RSr2gZ2wkurY3gCghhMjirEAS++Sqyit ZRqJsZAgfBQGaLQijy7KnjChC/r5foECoiLr2H8lBLmR+n+3uG6nP08eR98PsQZm 8ZGKKUpaal4or2vHn6gTKrrRR4yC4WbHhpeq700Y4MUY2koKS4o= =cBFO -----END PGP SIGNATURE-----