-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Fri, 17 Jul 2026 00:13:38 +0200 Source: roundcube Architecture: source Version: 1.6.5+dfsg-1+deb12u10 Distribution: bookworm-security Urgency: high Maintainer: Debian Roundcube Maintainers <pkg-roundcube-maintainers@alioth-lists.debian.net> Changed-By: Guilhem Moulin <guilhem@debian.org> Closes: 1138086 1141495 Changes: roundcube (1.6.5+dfsg-1+deb12u10) bookworm-security; urgency=high . * Cherry pick upstream security fixes from v1.6.17 (closes: #1141495): + Fix CVE-2026-62642: Infinite loop in TNEF (winmail.dat) decoder. + Fix CVE-2026-62644: Various vulnerabilities in the password plugin using session-injected username. + Fix CVE-2026-54432: Stored XSS via unescaped attachment MIME type on the attachment-validation warning page. + Fix CVE-2026-62643: SSRF bypass via specific local address URLs. + Fix CVE-2026-54433: Zero-click stored XSS in plain-text rendering. + Fix CVE-2026-62641: DoS via crafted compressed-RTF size in the TNEF (winmail.dat) file. * Fix out-of-bounds string reads on truncated compressed-RTF in the TNEF decoder. * d/p/Avoid-dependency-on-new-package-mlocati-ip-lib.patch: Drop type annotations to restore compatibility with PHP<8 (closes: #1138086). Checksums-Sha1: a37333c38dfef3c06f765f4c257dded1b5cb5185 3837 roundcube_1.6.5+dfsg-1+deb12u10.dsc 53cfbe760281a9aa0aaad866534690844f45b55d 254512 roundcube_1.6.5+dfsg-1+deb12u10.debian.tar.xz 9fe77020971b0e600c2e2e1683f29c283b5b1765 6256 roundcube_1.6.5+dfsg-1+deb12u10_source.buildinfo Checksums-Sha256: 1736a0f0bb18a5f01d792086a622759c286d0218af4ab1e27741bb16b72fe593 3837 roundcube_1.6.5+dfsg-1+deb12u10.dsc 882841b32ae693ebc827b1477bd94cc46b5fc45ffdd5f3bee2f6f8b65df0c802 254512 roundcube_1.6.5+dfsg-1+deb12u10.debian.tar.xz 52a5e848f295d979ae54439368fd131b6ba7b310a18e01a500b4b7785fe976da 6256 roundcube_1.6.5+dfsg-1+deb12u10_source.buildinfo Files: 74e3af741c90a2b295aa3a2ba7e716ef 3837 web optional roundcube_1.6.5+dfsg-1+deb12u10.dsc b2a8387cc105b5346f62440abd4ecc06 254512 web optional roundcube_1.6.5+dfsg-1+deb12u10.debian.tar.xz 950632cedc952cebdcad68e8be07ea5e 6256 web optional roundcube_1.6.5+dfsg-1+deb12u10_source.buildinfo -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEERpy6p3b9sfzUdbME05pJnDwhpVIFAmpgA98ACgkQ05pJnDwh pVKp/Q//VOQ6no/hBx/SIVdG+svpLLs4wONycBmyXr8BDX6MPLOt+jnwEyFsw+8w xA2TnfsNpkXNk/BZBIeyOyz2y8L1SaJH+PKGe5cd+8WM9+xErJT1qipIahUmpcQl IxwbVYDxJOJiW3u9ETSfIEWG5eRdWzDKN/ci/GtC4RAkNS4nc3TsWBQhiu6ghf4L JhyhKdlDmlSoaIOx7rEoZrdQhQuO0f49vo0ChM5++b56t2YWJFFF4LTFyZlmzgyE FWKUNYoBbI5aU7do8RZFZ1Q+bW4+3X4GPuZKjCY8UAkzNNf156x9aIFDnEe/WHoC oRLPMwxJQSlFSoY8/tHctLs/AShDiClVpUGoM7J6MNwNwq4GXcF2FH0Pom9/G6mR e38qT4gi1Bw3tsfpr3nQW+KskQMw0lXqAeLE5/PxJeHKjRkBfl9vPz1YLJDkEbMS sE5X4klr3YlEpepeR8BIFFBSbRGHWQud4Vnk2ZQlzyxjauFavXVZ2T2Igof/MPfL IhlEk7B3bjV2KLi1UVSt2hMU0FUBUS8GHn7ZKTx/a4SAAVYm+ODY4t3F8/N4nAo9 EoUljfgScrV9SE8EuaQ4HfBreYd8aMnYmODUpZo7aBwAXaOtn3eBbjIDhUATIYuA n9v35I1P0mRqVsHdbqf0425ia/5h8Q2hCIvUk1y0BtfTfG7DS/w= =z7k8 -----END PGP SIGNATURE-----
