-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Tue, 06 Aug 2024 16:02:54 +0200 Source: roundcube Architecture: source Version: 1.6.5+dfsg-1+deb12u3 Distribution: bookworm-security Urgency: high Maintainer: Debian Roundcube Maintainers <pkg-roundcube-maintainers@alioth-lists.debian.net> Changed-By: Guilhem Moulin <guilhem@debian.org> Closes: 1077969 Changes: roundcube (1.6.5+dfsg-1+deb12u3) bookworm-security; urgency=high . * Cherry pick upstream security fixes from v1.6.8 (closes: #1077969): + CVE-2024-42008: Cross-site scripting (XSS) vulnerability in serving of attachments other than HTML or SVG. + CVE-2024-42009: Cross-site scripting (XSS) vulnerability in post-processing of sanitized HTML content. + CVE-2024-42010: Fix information leak (access to remote content) via insufficient CSS filtering. * Cherry pick further upstream changes from v1.6.8: + Fix fatal error when parsing some TNEF attachments. + Fix bug where an unhandled exception was caused by an invalid image attachment. + Fix infinite loop when parsing malformed Sieve script. + Fix bug where imap_conn_option's 'socket' was ignored. Checksums-Sha1: 745d8202211278dff06f4206d06f9a62e1929c8a 3833 roundcube_1.6.5+dfsg-1+deb12u3.dsc ab7db7a6805b1892ece174c3ea011df9c0c607ca 119360 roundcube_1.6.5+dfsg-1+deb12u3.debian.tar.xz fc151fed1d0261a1d752380fc32aa35acc6b6dff 14215 roundcube_1.6.5+dfsg-1+deb12u3_amd64.buildinfo Checksums-Sha256: 05dc579c8ae58dcde33c90501eada1b259ce5faefa2357cdf1cdb6a8d51a946f 3833 roundcube_1.6.5+dfsg-1+deb12u3.dsc e8a60d68e4def4ce034aca3dc3fd59f67185a98f408329155565985e7d638e6f 119360 roundcube_1.6.5+dfsg-1+deb12u3.debian.tar.xz 29acd0c922ffde454739088d88f13a17fadb48a200a341bab0e1f7ccd784f44e 14215 roundcube_1.6.5+dfsg-1+deb12u3_amd64.buildinfo Files: 061ad7c1808273d438dfc7f77d953135 3833 web optional roundcube_1.6.5+dfsg-1+deb12u3.dsc db41a1315aea78b3c2300192b7e878cd 119360 web optional roundcube_1.6.5+dfsg-1+deb12u3.debian.tar.xz d2ae2bb5c4b6ba9788a72de5d92f4a3e 14215 web optional roundcube_1.6.5+dfsg-1+deb12u3_amd64.buildinfo -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEERpy6p3b9sfzUdbME05pJnDwhpVIFAmayLsAACgkQ05pJnDwh pVL2mxAAt+6z7rXfuNSOjklv29W+cssixDgpne+QqWuFVFKKTYAsVZ7AvcXSb1uf p+H01ZCW+GVLz0Z+ms1v+xqOlkVbxAVrhmnOrSOwbrlAEGjJG+limoLXm0ySi2fF /OHsMXQpMwz+tMBvXj6RM25FzTeI8T015DHhIrDhIl/bgaa0pfeQV1VPmLSpTro4 zCsl36V9AneX2c8AH8jN4iwj7ZzVOjaCqwyauZBIJ+JCnJoCP+NadQqLYLrhM2yG F5Q3ouEROtallIGdmq/c9S5d/WwCshpjUu0s23xGo+ACrdMKPIIqHxS5TXmKMyvM 7sbEgL1QzKAAmA2SSr3K4yG5xNy9T4BRHcOQLgyv7BG01W2SB9fTIn2YhrmFaMXh Cx9sUYHxZsI2Kx8ip1O7/KXTbfS6pJjVKcOO7gJYvvKdBYtVR+G8WqRxLI5u0vgw YN87Z59M+kQGiBMeCTCh2vf3HB7sPWqKcQDQz0bfZv/VdAsF6XYI7r/Lgi5ps/jZ 773CnvpVil4Wv3zskQAZVbhmpt99VMnkEyzCVk04kWruMQAcagGM+cqoswTqT5Ge OA+5SAKGkKo1vkX5to6zCIjhs8lkpCki89fSM1ZqRcjw+6qiw5qgBUZpqPoi+sMn L1b0Tdy7I7kp45heZnE2ZXqsbEBIl31yiyk4EKknbcktEIRq0c0= =Oro8 -----END PGP SIGNATURE-----
