-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Sat, 29 Aug 2026 17:39:34 +0200 Source: roundcube Architecture: source Version: 1.4.15+dfsg.1-1+deb11u11 Distribution: bullseye-security Urgency: high Maintainer: Debian Roundcube Maintainers <pkg-roundcube-maintainers@alioth-lists.debian.net> Changed-By: Guilhem Moulin <guilhem@debian.org> Closes: 1144059 Changes: roundcube (1.4.15+dfsg.1-1+deb11u11) bullseye-security; urgency=high . * Backport upstream security fixes from v1.6.18 (closes: #1144059): + Fix CVE-2026-74998: Content proxied by the css proxy is not validated validation. + Fix CVE-2026-75006: SSRF bypass via specific local address URLs using 100.64.0.0/10 and fe80::/10 subnets. + Fix CVE-2026-75006: SSRF filter bypass via various forms of nip.io/sslip.io hostnames evading `is_local_url()` check. + Fix CVE-2026-75003: Remote content blocking bypass via unclosed `url()` in a FuncIRI attribute. + Fix CVE-2026-75007: LDAP filter injection via unescaped %u/%fu/%d substitution into the `search_filter`. + Fix CVE-2026-75004: Arbitrary sieve script injection via a filter rule name bypassing `managesieve_disabled_actions`. + Fix CVE-2026-74997: RCE in the `cmd_learn` driver of markasjunk plugin. + Fix CVE-2026-75002: IMAP command injection via mail search and LITERAL+ byte-count desynchronization. + Fix CVE-2026-75010: The modoboa driver of the passwd plugin leaks an authentication token to a user-controlled host. + Fix CVE-2026-74999: Stored XSS in "Add to address book" action. + Fix CVE-2026-75000: HTML/CSS sanitization bypass via SVG animate `by` attribute. Checksums-Sha1: 43f7ac963c4a52d7a29144b2a16c42dba7ebc02e 3280 roundcube_1.4.15+dfsg.1-1+deb11u11.dsc fb0b5deacca5863d37a0b10c3771f27c91d4545e 128840 roundcube_1.4.15+dfsg.1.orig-tinymce-langs.tar.xz a53c61b8ec041aa5a15be0da438a990a34acc072 889052 roundcube_1.4.15+dfsg.1.orig-tinymce.tar.xz a3591df13cae970b04c53651221f316ba521c473 2976560 roundcube_1.4.15+dfsg.1.orig.tar.xz b7f4321ff5128e2013a1c93e5d89af0915ba3564 135404 roundcube_1.4.15+dfsg.1-1+deb11u11.debian.tar.xz 3f6689d416db5a1565ffeec6d99253bf6a9b0af3 5929 roundcube_1.4.15+dfsg.1-1+deb11u11_source.buildinfo Checksums-Sha256: ae53a38b39c423cb8f0ef7a6ce7dc3dd7dfcd1500f740cd668529afd02561650 3280 roundcube_1.4.15+dfsg.1-1+deb11u11.dsc d1806e62b75b5e2c8bbbce987abd3eae874f205dd560ad8f6f02a2171c8cf23a 128840 roundcube_1.4.15+dfsg.1.orig-tinymce-langs.tar.xz b61678512254fc2af25a42ac689ac6df69bdf6d15d7aea6e9001c8868653ee74 889052 roundcube_1.4.15+dfsg.1.orig-tinymce.tar.xz f56e664cddb698cf0eeefb1a34dd495ce0e6d29643b2e2ec0ae5cb9c6342882f 2976560 roundcube_1.4.15+dfsg.1.orig.tar.xz 8367e616525ac39d55d6606fa5b5c9e0c60e1a05e32e372e76f410a5178fce7d 135404 roundcube_1.4.15+dfsg.1-1+deb11u11.debian.tar.xz ad696d302dc07cdb2d08813ff91109cf59f8d38379b11515657442a1a7ba35de 5929 roundcube_1.4.15+dfsg.1-1+deb11u11_source.buildinfo Files: 4bc812f20e105346c580c53fb0b994a3 3280 web optional roundcube_1.4.15+dfsg.1-1+deb11u11.dsc 450c693c68d2642b15356d06255a0d4c 128840 web optional roundcube_1.4.15+dfsg.1.orig-tinymce-langs.tar.xz 5b440fff53353d7c0ad73292c1cfe6e2 889052 web optional roundcube_1.4.15+dfsg.1.orig-tinymce.tar.xz e98d3d252094ea231c3b02a3ff39471a 2976560 web optional roundcube_1.4.15+dfsg.1.orig.tar.xz ab5cf7030dd2a7530dbe8ebff3c689c4 135404 web optional roundcube_1.4.15+dfsg.1-1+deb11u11.debian.tar.xz 8ad27e1abb8145472a28473bbf4178ff 5929 web optional roundcube_1.4.15+dfsg.1-1+deb11u11_source.buildinfo -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEERpy6p3b9sfzUdbME05pJnDwhpVIFAmqTIXsACgkQ05pJnDwh pVIoyxAAv93I4XTSIgwmJx1I+NJ6nsvXNBOgJJp1ACBclHC2UAppGV8JODxwFeIn 8zLfRBRHHzjBkmc39kGM7lY+Dp3d50YG/mnsgJHNnibZaJNBsedMt1mGW0fdGLs7 lJGNtpVS8U391DPl0F3+sD29qLfoyyQZTu2ebcdcxIsfIqmz4wWtrLdOqzqynT6c xNpsiAxRge201DIjOjt6Y9Q7YeNAyedmGedYYv5Hfi1Ps0LzkzmczRTuDvOoKSuy lDof2nrK2eJ+hjs5wJ7Hcr7KbvDDjKOAU78Aaru+HZL7n+Z+S38mcFt9Gl/CSJhy Gc7v+CLvyFnOft1djp4YlEa0nx1vWKmt1CDkbLYVrg1upcYCnBh7gn+x46udyReM nWVFJMpc/RPuSwK8LlgE674+5d3yp6hSL+t30wZWOQME1t7hl15LRoOLsXfTq0Cc Uv89CXsxS5fMwAN99cNCgk4zBDPZQrCRIK2fk1Yo/vH3BTU0mNqLwDk9AnjFyfHu MH3dsR5FLN6HbZ1cOJj2JMQBJ9Ec5ghh1DbDds3t6M1cXCJ+VlXQE+qHr6nfoFOW Lq88+avqhrsR3DHYBZfsR3VXGRUCdiTab9HIUHv/UL3/QrLWBEVXuDo7B0hHxpZ6 JEo3Fon4DjljpVEBA7u/xSoVTG3Ar6xiaeDvrNha7HjWniva3/A= =A+91 -----END PGP SIGNATURE-----
