-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Sat, 29 Aug 2026 15:58:59 +0200 Source: roundcube Architecture: source Version: 1.6.5+dfsg-1+deb12u11 Distribution: bookworm-security Urgency: high Maintainer: Debian Roundcube Maintainers <pkg-roundcube-maintainers@alioth-lists.debian.net> Changed-By: Guilhem Moulin <guilhem@debian.org> Closes: 1144059 Changes: roundcube (1.6.5+dfsg-1+deb12u11) bookworm-security; urgency=high . * Cherry pick upstream security fixes from v1.6.18 (closes: #1144059): + Fix CVE-2026-74998: Content proxied by the css proxy is not validated validation. + Fix CVE-2026-75006: SSRF bypass via specific local address URLs using 100.64.0.0/10 and fe80::/10 subnets. + Fix CVE-2026-75006: SSRF filter bypass via various forms of nip.io/sslip.io hostnames evading `is_local_url()` check. + Fix CVE-2026-75003: Remote content blocking bypass via unclosed `url()` in a FuncIRI attribute. + Fix CVE-2026-75007: LDAP filter injection via unescaped %u/%fu/%d substitution into the `search_filter`. + Fix CVE-2026-75004: Arbitrary sieve script injection via a filter rule name bypassing `managesieve_disabled_actions`. + Fix CVE-2026-74997: RCE in the `cmd_learn` driver of markasjunk plugin. + Fix CVE-2026-75002: IMAP command injection via mail search and LITERAL+ byte-count desynchronization. + Fix CVE-2026-75010: The modoboa driver of the passwd plugin leaks an authentication token to a user-controlled host. + Fix CVE-2026-74999: Stored XSS in "Add to address book" action. + Fix CVE-2026-75000: HTML/CSS sanitization bypass via SVG animate `by` attribute. Checksums-Sha1: 963f9778ffb60efcb2a89f765749c0c77ab34988 3837 roundcube_1.6.5+dfsg-1+deb12u11.dsc 830c2f0bcdf2abe90fe047e370a8ef4325264cd5 258852 roundcube_1.6.5+dfsg-1+deb12u11.debian.tar.xz 18c7a882ffb06aef7a17da783be5b00449c6024a 6268 roundcube_1.6.5+dfsg-1+deb12u11_source.buildinfo Checksums-Sha256: fc3c47a9d890414cf42a81d8dc4b23821eda250ab6456d1bc3f8d9b8e8d1e2c8 3837 roundcube_1.6.5+dfsg-1+deb12u11.dsc 6127db6e91705b2b8e6189b98c6bd6841097f7e88099dfc0888bded03f618675 258852 roundcube_1.6.5+dfsg-1+deb12u11.debian.tar.xz f1be0da6f19ed52ca31cd8511895fb299d69a9a55fbce57982671af8c681d1c6 6268 roundcube_1.6.5+dfsg-1+deb12u11_source.buildinfo Files: 2768cab18ca5b677d76441c6f3ed5a59 3837 web optional roundcube_1.6.5+dfsg-1+deb12u11.dsc 8a06494ce912e32e1ea28dc7e4de3ca4 258852 web optional roundcube_1.6.5+dfsg-1+deb12u11.debian.tar.xz edfc30cd40815240a59392d86edc297e 6268 web optional roundcube_1.6.5+dfsg-1+deb12u11_source.buildinfo -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEERpy6p3b9sfzUdbME05pJnDwhpVIFAmqTIWAACgkQ05pJnDwh pVJBSQ//S/8xNA2YhN/fww1Zu7++xKQgIH4HVlwwvZ5Fxl2vwQmTpjdI0PoYNn1r VJ+Xdi/gWbtmq3ZsoleWp9QYzIccO/9v1Sc6thGGkG4T5Tt4SrI3lvb0Ekc+KRK7 4NFBgoTf97OJfPxGtPqgy0L90fTty5jek5N/nB5hXK70lORtUJC3MzpKV+3Caul0 ikXdYyknpqLBHA49APH+Z9poyMDuQmf0pfGnh8dAxNaqs/cvI5kOrIGshfZX6ptZ bgDkssjDA44UWauRkI+R0iiXhFkwm9lCFORv4pA0Y3akyjS8pICWUC71oyjlICkW MZb8udvZDIi5SJW080wIYdJE/nPivvKtFb6UoVTW2ngBYDTLRt1sI3Pf7Y76k9DC XeczMEAk6WTxP0n5YXGREaNcgOxJ66gJIT6AckZwdqaEujQTx8R9sfbR8PxuAsHq x8CxzUCZ2O1UZpppURKqI3XrftWdK5k5NXkx02n/Tcm2UuWOo2NFau+h4DA+c6w0 SQ3oqvZyHeObJjJn3LYvfB8spsswGjSSHUQBcNIJTGpgsiQHAlLVCbyPaeqbTGvb h5sU/++cC/W/8hJq0dQwoyVVyCdVWTrgUviocDdUzQCuMPGJ2Ns3LSrIfYZprh98 KAFFccFzQR2cviNuXeyZ/tTj8PB8k8rrKPhR8pZj1uTaP227aVU= =pWCz -----END PGP SIGNATURE-----
