-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Mon, 10 Aug 2026 15:15:16 +0200 Source: roundcube Architecture: source Version: 1.6.18+dfsg-1 Distribution: unstable Urgency: high Maintainer: Debian Roundcube Maintainers <pkg-roundcube-maintainers@alioth-lists.debian.net> Changed-By: Guilhem Moulin <guilhem@debian.org> Closes: 1144059 Changes: roundcube (1.6.18+dfsg-1) unstable; urgency=high . * New upstream security and bugfix release (closes: #1144059). + Content proxied by the css proxy is not validated validation. + SSRF bypass via specific local address URLs using 100.64.0.0/10 and fe80::/10 subnets. + SSRF filter bypass via various forms of nip.io/sslip.io hostnames evading `is_local_url()` check. + Remote content blocking bypass via unclosed `url()` in a FuncIRI attribute. + LDAP filter injection via unescaped %u/%fu/%d substitution into the `search_filter`. + Arbitrary sieve script injection via a filter rule name bypassing `managesieve_disabled_actions`. + RCE in the `cmd_learn` driver of markasjunk plugin. + IMAP command injection via mail search and LITERAL+ byte-count desynchronization. + The modoboa driver of the passwd plugin leaks an authentication token to a user-controlled host. + Stored XSS in "Add to address book" action. + HTML/CSS sanitization bypass via SVG animate `by` attribute. * Refresh d/patches. * Cherry-pick follow-up change to fix PHP warning in markasjunk's cmd_learn.php. Checksums-Sha1: 7baebfb91ba8cd774b09a1bd9eba8aa358da1c5e 3845 roundcube_1.6.18+dfsg-1.dsc d1f446017c4ecc7d79a0ea6b465feb3fbee7b9c7 126948 roundcube_1.6.18+dfsg.orig-tinymce-langs.tar.xz af0bba30402c4c02beaca3ae96ac6aa12a4a6da6 1928640 roundcube_1.6.18+dfsg.orig-tinymce.tar.xz 2b80f406956df4da1213893520778b94814aacd0 2907948 roundcube_1.6.18+dfsg.orig.tar.xz 5ac234f7d61dc9868667328b0a4c4617739a8ebb 159932 roundcube_1.6.18+dfsg-1.debian.tar.xz 2444dd3097df882acdd772fdca20517a664e9ce8 6267 roundcube_1.6.18+dfsg-1_source.buildinfo Checksums-Sha256: 23b49565b6327af40aad18bfe286f31846ea242b356a7ab420e3c26eb8959ae3 3845 roundcube_1.6.18+dfsg-1.dsc f009f44443e465cd7a06a758cb878402868f61b47762bf247f572fd2b3fd1bfb 126948 roundcube_1.6.18+dfsg.orig-tinymce-langs.tar.xz 518547256094a0214580e18b22693cc63d54dd059d8a8116a967898c854a7acb 1928640 roundcube_1.6.18+dfsg.orig-tinymce.tar.xz b413364d67014758eb4a4b87adc2a0f465e0a0bedf23d644d61955280f1df900 2907948 roundcube_1.6.18+dfsg.orig.tar.xz 1c542e61291d3fa88aa4f3012eecd69dbb549291572e2d97d270bf62ea85ce84 159932 roundcube_1.6.18+dfsg-1.debian.tar.xz 8f31c303e98a4e46b1cf2528489ad219003b173f9a74fa5bd094de19604eac0c 6267 roundcube_1.6.18+dfsg-1_source.buildinfo Files: cc4f51b8b3dd63b2d0dd5af04c67b65d 3845 web optional roundcube_1.6.18+dfsg-1.dsc 6d1099a82016ca3d45dbba79295f6e30 126948 web optional roundcube_1.6.18+dfsg.orig-tinymce-langs.tar.xz 49949888729c8204636bc14cffcfa003 1928640 web optional roundcube_1.6.18+dfsg.orig-tinymce.tar.xz 8e988bb1541cf388be0bd2630e01dc90 2907948 web optional roundcube_1.6.18+dfsg.orig.tar.xz 37bae46e8fd6d258d674b855336ceea8 159932 web optional roundcube_1.6.18+dfsg-1.debian.tar.xz 6c177af0cd190b55038131044b936f6d 6267 web optional roundcube_1.6.18+dfsg-1_source.buildinfo -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEERpy6p3b9sfzUdbME05pJnDwhpVIFAmp6RvgACgkQ05pJnDwh pVK7GQ/8DWHdVZIVwciMppsNtzrrBlT14Hhq4XzHJRrFYPO9gGjl7NfU3kubRBqD C3OqRAznGR5jWJEGNODdKqnE/gG7wd3fp5D5wlljpsCtp4knjuqV0JWqf95WI3f1 qyv4MI8Lo2RDCQ0+zfUd1chnHFj8sX8jJKBYSyUVGA2ZuTUnVBvvLHavzz79lRGY cgp+CSkYMHLDSgUF6YjwtHf40myCWhtIPCj+HoTIc7jLXXT7ugmLeEXB0wN/SRmK wJhxJtBJ4aeiLlwtAsv1aLAelpreyHw+9506wg5hLSXaTZOHAWxTzw4LZkOX1KSV CHwO+3fECnp96ieJR3LH7m9GRizgVCwOKg+N1DQdwTmutOT+NP01YE/Tl5P0LBFv XZRvS5/zFxz1T9SbNGCMJZLIhQb+6i5kl5c+XYHYuHxGLovbLal3rMg+TwyZi2Au wijKc9BGVUVX3NpHrvYywnbIsu6OAFNmsBGIK/Ml1Mx51rxojhCSNo/oHkoTSUtP Wlesnod5vyRT08sOLvC2F1Fo2hCbKbR3fQKzIBHomk+gJ4KSMB9tDvWpYOls8LD+ ObD5racM2b8OcfzpwFHvplzCVOYKbyBxJXSRa5LD/c/v94+2bueG2KOLSLvRmhr4 BovKQKTKzdQEUJnBCl5ytWMPFvYIH+DfBqd2tyPydI7Z3tM7FEs= =Z2b7 -----END PGP SIGNATURE-----
