-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Wed, 08 Jul 2026 12:46:28 +0200 Source: roundcube Architecture: source Version: 1.6.17+dfsg-0+deb13u1 Distribution: trixie-security Urgency: high Maintainer: Debian Roundcube Maintainers <pkg-roundcube-maintainers@alioth-lists.debian.net> Changed-By: Guilhem Moulin <guilhem@debian.org> Closes: 1138086 1141495 Changes: roundcube (1.6.17+dfsg-0+deb13u1) trixie-security; urgency=high . * New upstream security and bugfix release (closes: #1141495). + Fix CVE-2026-62642: Infinite loop in TNEF (winmail.dat) decoder. + Fix CVE-2026-62644: Various vulnerabilities in the password plugin using session-injected username. + Fix CVE-2026-54432: Stored XSS via unescaped attachment MIME type on the attachment-validation warning page. + Fix CVE-2026-62643: SSRF bypass via specific local address URLs. + Fix CVE-2026-54433: Zero-click stored XSS in plain-text rendering. + Fix CVE-2026-62641: DoS via crafted compressed-RTF size in the TNEF (winmail.dat) file. + Enigma: Add support for automatic public key lookup (import) using HKP v1 protocol. + Enigma: Add support for Kolab's Web Of Anti-Trust (WOAT) feature. * d/p/Avoid-dependency-on-new-package-mlocati-ip-lib.patch: Improve patch and drop type annotations to restore compatibility with PHP<8 (closes: #1138086). * Refresh d/patches. Checksums-Sha1: 49a5435593fa17063d28734aeadfb72ab0238f67 3860 roundcube_1.6.17+dfsg-0+deb13u1.dsc c42a03f7b7f449f7ec9023843d775b66e2887e31 126836 roundcube_1.6.17+dfsg.orig-tinymce-langs.tar.xz a14b229b6767817fb36d85c6c22b700e81fcc74a 1928888 roundcube_1.6.17+dfsg.orig-tinymce.tar.xz 1f753251c7e378540cea602af4a7f5db415764fa 2906816 roundcube_1.6.17+dfsg.orig.tar.xz 17ff58ec398626d36c55feda9620efc00f4871ba 157648 roundcube_1.6.17+dfsg-0+deb13u1.debian.tar.xz 0b149df20a93f3ad1a11319b242b2cf565a59952 6256 roundcube_1.6.17+dfsg-0+deb13u1_source.buildinfo Checksums-Sha256: 921dd7ea1f6d00ee1ffdf4c3d490fd5fd2e50351b344ebda9962d29668e49399 3860 roundcube_1.6.17+dfsg-0+deb13u1.dsc a9e0dcf588cdfd398b1ffacb63d3cc6cf2132785adcf98b9bc3cb7b23f9f1f6e 126836 roundcube_1.6.17+dfsg.orig-tinymce-langs.tar.xz 870c74fc7fe5f66929a8f45b7340be3d542d94ef5786d92393bfbf687c57b1fa 1928888 roundcube_1.6.17+dfsg.orig-tinymce.tar.xz c32cae39892d8936f1b07712e0cda3f435d311cd095e6d949d8e62c473ae1426 2906816 roundcube_1.6.17+dfsg.orig.tar.xz 1c961cee680df5c0a37d474f51663f4bbff85a3fbe67cd60fafb253623f54e5e 157648 roundcube_1.6.17+dfsg-0+deb13u1.debian.tar.xz a809dad1f9367a68c04d292ab86caef14fe164f24b976af2c62a6787bbd55e77 6256 roundcube_1.6.17+dfsg-0+deb13u1_source.buildinfo Files: 8694c4b8a031452951773cb5c74a1620 3860 web optional roundcube_1.6.17+dfsg-0+deb13u1.dsc 14e66bb6839218d4add3e1fbea68952d 126836 web optional roundcube_1.6.17+dfsg.orig-tinymce-langs.tar.xz d1198f417f0ae874dedee8a12e7c8713 1928888 web optional roundcube_1.6.17+dfsg.orig-tinymce.tar.xz dc32d01c80607b6c6ab3a206e354e584 2906816 web optional roundcube_1.6.17+dfsg.orig.tar.xz eda7bcd661733eff99573717fca5beeb 157648 web optional roundcube_1.6.17+dfsg-0+deb13u1.debian.tar.xz d1251ffc0525b5bbaac880b1e8fe6601 6256 web optional roundcube_1.6.17+dfsg-0+deb13u1_source.buildinfo -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEERpy6p3b9sfzUdbME05pJnDwhpVIFAmpWxVgACgkQ05pJnDwh pVIGRA//bGj8I891f1ENWx0y2oMV+Ef6/Lq8nXUArKAS3TZmfbyBrKRsvBjHECbl rMzXz+rIJ1O9SO3zzR+IJpjjCdfvdkqR+R35X2p3ypZ4eogdVC56Kwvz3I1F6kq0 FWea9pOkN9zwuO8F6Rdwz9hE2Y8fw/oKqEFhU4YS/wKJCkpPFN7jvRlleLyjAO+I oaO/++oSdddjFw5ZyZ340ESkQyvbaReoMQir2NG1TEO5gs6tzCjo1dCFA7Qh2gD8 zYVKcBwnuYl48FDvth+AC9ukDGStAJe+K7XG8me6zWtRpVofjgAsZhuJYnL+Xx6R MM5iewx1s7JdAIZ2MqZn/QGxWFmJDFfjzuo/yYUbiysgXPP6Nnw584JPMJ1iFp4E Kc04tn/lnUBC3dlSHkoiz0IJvlNtJf6UsrFZ7N3aDSG9qc2F45GnLaq+77zbPADr r9EyWfcaLEODWStERAtmOrJkOhFpgH7PpyZAUF3AfnjCjWFZIWKG7zsE9cr9yReg 1nSVHag+Dfel5ntZKQECjQ9qipXUMaZm7OwRqTSo1q2Ce7EKGTsRbEPk56vZcTr0 90WCFKWaJ27nhvjADRJdbnf2abArIuqLP0diR9j+/FvMXEyuTn+w0UqqbQEoGUAq a/QsMM1kmmQne5g7OT3xwpbx+GKwEN8vjjSc9jqUO8X8WhV40C0= =bJ+5 -----END PGP SIGNATURE-----
