-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Fri, 17 Jul 2026 01:16:48 +0200 Source: roundcube Architecture: source Version: 1.4.15+dfsg.1-1+deb11u10 Distribution: bullseye-security Urgency: high Maintainer: Debian Roundcube Maintainers <pkg-roundcube-maintainers@alioth-lists.debian.net> Changed-By: Guilhem Moulin <guilhem@debian.org> Closes: 1137507 Changes: roundcube (1.4.15+dfsg.1-1+deb11u10) bullseye-security; urgency=high . * Backport upstream security fixes from v1.6.17 (closes: #1137507): + Fix CVE-2026-62642: Infinite loop in TNEF (winmail.dat) decoder. + Fix CVE-2026-62644: Various vulnerabilities in the password plugin using session-injected username. + Fix CVE-2026-54432: Stored XSS via unescaped attachment MIME type on the attachment-validation warning page. + Fix CVE-2026-62643: SSRF bypass via specific local address URLs. + Fix CVE-2026-54433: Zero-click stored XSS in plain-text rendering. + Fix CVE-2026-62641: DoS via crafted compressed-RTF size in the TNEF (winmail.dat) file. Checksums-Sha1: 3c205bbf8680f316bb754557c8fb18ecf3dca1d8 3280 roundcube_1.4.15+dfsg.1-1+deb11u10.dsc fb0b5deacca5863d37a0b10c3771f27c91d4545e 128840 roundcube_1.4.15+dfsg.1.orig-tinymce-langs.tar.xz a53c61b8ec041aa5a15be0da438a990a34acc072 889052 roundcube_1.4.15+dfsg.1.orig-tinymce.tar.xz a3591df13cae970b04c53651221f316ba521c473 2976560 roundcube_1.4.15+dfsg.1.orig.tar.xz ad519f5c0a96dd719f45f2305466ff4bda74013c 130596 roundcube_1.4.15+dfsg.1-1+deb11u10.debian.tar.xz 71ec1d6c6c57728431ccd4a6da2e30b76bb6ffd0 5918 roundcube_1.4.15+dfsg.1-1+deb11u10_source.buildinfo Checksums-Sha256: 7271add0430a5c0749ebfcada3d3a584e12af21fdf89dc534d82c33cf8c6f885 3280 roundcube_1.4.15+dfsg.1-1+deb11u10.dsc d1806e62b75b5e2c8bbbce987abd3eae874f205dd560ad8f6f02a2171c8cf23a 128840 roundcube_1.4.15+dfsg.1.orig-tinymce-langs.tar.xz b61678512254fc2af25a42ac689ac6df69bdf6d15d7aea6e9001c8868653ee74 889052 roundcube_1.4.15+dfsg.1.orig-tinymce.tar.xz f56e664cddb698cf0eeefb1a34dd495ce0e6d29643b2e2ec0ae5cb9c6342882f 2976560 roundcube_1.4.15+dfsg.1.orig.tar.xz bb443a222fdd36c92dadcefa9f5b9e2ad5579007404e4c841444ff357327b411 130596 roundcube_1.4.15+dfsg.1-1+deb11u10.debian.tar.xz dd8d85672ee43a1adee654c930d7eabf89c0238c0d03fa4b5749c3f204849eeb 5918 roundcube_1.4.15+dfsg.1-1+deb11u10_source.buildinfo Files: 6edfc1121280e6fced2163c57bb67cee 3280 web optional roundcube_1.4.15+dfsg.1-1+deb11u10.dsc 450c693c68d2642b15356d06255a0d4c 128840 web optional roundcube_1.4.15+dfsg.1.orig-tinymce-langs.tar.xz 5b440fff53353d7c0ad73292c1cfe6e2 889052 web optional roundcube_1.4.15+dfsg.1.orig-tinymce.tar.xz e98d3d252094ea231c3b02a3ff39471a 2976560 web optional roundcube_1.4.15+dfsg.1.orig.tar.xz a974bea748e28c658bb441f97ee4511b 130596 web optional roundcube_1.4.15+dfsg.1-1+deb11u10.debian.tar.xz ec22127780eea2e27bdc7294e09e0391 5918 web optional roundcube_1.4.15+dfsg.1-1+deb11u10_source.buildinfo -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEERpy6p3b9sfzUdbME05pJnDwhpVIFAmpgA+gACgkQ05pJnDwh pVKJMw//cTpQ4bNjynCohRWX75pfEiqLvCAsWAfk3/QRulLPBHAezVvgaYbie8b5 uTBeYKIdJ5i1jeFjkhbqMuzai5oGDynPyMqaNF2eD68Q+Rn5HKTi6gC2pUwFQVCz rQtfiDGkuppeUi0maxVfXzkk2WS2eNTie0xgjYHBeSQm3IQtrdWuh0XEpuFriPfG s7MG8AoGWos5Jj9XkRVD4NB72j/SN4nYfrG8KHlt3jwsfd0yWhBpdep4bk7Axm1O NRosKkzg8IZnwqH+dmSLKlm7jzoYskgkSh9a10eFWQjhCIba0ZOYSJinOlstB+hz JGYz5OYqz0D/cYCFYHqSkhccxfWYcCg1dZRlIl4En3Fey5tlBzTdscY6JPVrEmKh nY9QByrBheRBuNgDjaSG8nShABltpv7XnUc6HaqPyT/SA7Y+seN9DC/7bh2KyLRQ pbPkLUfQOYItma1IUlTIEr4BLFKhIbbzqGGP07oTMi5O/GulakruMlZYoC3LeH/r 3ho7/M4wT/x+UaVEWC+jLzqs+0VcbL1yq8r6w385yANpWU/BtyL+v4dqG6Qud2Vk /ibYVJfQe3OSHdOrXVh09adFm/Xi9SSs1EUFGvM4yNwog0d150V4obtSqkEQwtuD jFVrTtWovGxt9jCTE54v4Tl2mbBXhm6RFhUF2p9nV0s/X3hE1oQ= =0NqE -----END PGP SIGNATURE-----
