-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Mon, 10 Aug 2026 15:45:10 +0200 Source: roundcube Architecture: source Version: 1.6.18+dfsg-0+deb13u1 Distribution: trixie-security Urgency: high Maintainer: Debian Roundcube Maintainers <pkg-roundcube-maintainers@alioth-lists.debian.net> Changed-By: Guilhem Moulin <guilhem@debian.org> Closes: 1144059 Changes: roundcube (1.6.18+dfsg-0+deb13u1) trixie-security; urgency=high . * New upstream security and bugfix release (closes: #1144059). + Fix CVE-2026-74998: Content proxied by the css proxy is not validated validation. + Fix CVE-2026-75006: SSRF bypass via specific local address URLs using 100.64.0.0/10 and fe80::/10 subnets. + Fix CVE-2026-75006: SSRF filter bypass via various forms of nip.io/sslip.io hostnames evading `is_local_url()` check. + Fix CVE-2026-75003: Remote content blocking bypass via unclosed `url()` in a FuncIRI attribute. + Fix CVE-2026-75007: LDAP filter injection via unescaped %u/%fu/%d substitution into the `search_filter`. + Fix CVE-2026-75004: Arbitrary sieve script injection via a filter rule name bypassing `managesieve_disabled_actions`. + Fix CVE-2026-74997: RCE in the `cmd_learn` driver of markasjunk plugin. + Fix CVE-2026-75002: IMAP command injection via mail search and LITERAL+ byte-count desynchronization. + Fix CVE-2026-75010: The modoboa driver of the passwd plugin leaks an authentication token to a user-controlled host. + Fix CVE-2026-74999: Stored XSS in "Add to address book" action. + Fix CVE-2026-75000: HTML/CSS sanitization bypass via SVG animate `by` attribute. * Refresh d/patches. * Cherry-pick follow-up change to fix PHP warning in markasjunk's cmd_learn.php. Checksums-Sha1: 08e65ba30642d917165c92b6dc541f0f79061372 3860 roundcube_1.6.18+dfsg-0+deb13u1.dsc d1f446017c4ecc7d79a0ea6b465feb3fbee7b9c7 126948 roundcube_1.6.18+dfsg.orig-tinymce-langs.tar.xz af0bba30402c4c02beaca3ae96ac6aa12a4a6da6 1928640 roundcube_1.6.18+dfsg.orig-tinymce.tar.xz 2b80f406956df4da1213893520778b94814aacd0 2907948 roundcube_1.6.18+dfsg.orig.tar.xz baff8be4efdca960813d738101b458fcc42b1915 158552 roundcube_1.6.18+dfsg-0+deb13u1.debian.tar.xz 9086f022f790a7080109ade691905dd46f973c26 6268 roundcube_1.6.18+dfsg-0+deb13u1_source.buildinfo Checksums-Sha256: 79ef25e48f71d319a944019a8de929aec59d79ebcb092b0d3078fbb345bf63fb 3860 roundcube_1.6.18+dfsg-0+deb13u1.dsc f009f44443e465cd7a06a758cb878402868f61b47762bf247f572fd2b3fd1bfb 126948 roundcube_1.6.18+dfsg.orig-tinymce-langs.tar.xz 518547256094a0214580e18b22693cc63d54dd059d8a8116a967898c854a7acb 1928640 roundcube_1.6.18+dfsg.orig-tinymce.tar.xz b413364d67014758eb4a4b87adc2a0f465e0a0bedf23d644d61955280f1df900 2907948 roundcube_1.6.18+dfsg.orig.tar.xz b7633afa3585660a1822ae35d52769e72171cddd93504b8e5daf52de8ec91647 158552 roundcube_1.6.18+dfsg-0+deb13u1.debian.tar.xz 9979329dc63c4fd35fb7a1253156b9126f7aa5f6e975ad234b234638423e64bc 6268 roundcube_1.6.18+dfsg-0+deb13u1_source.buildinfo Files: 6295d7a0660cedfb8a2338d47522dcf6 3860 web optional roundcube_1.6.18+dfsg-0+deb13u1.dsc 6d1099a82016ca3d45dbba79295f6e30 126948 web optional roundcube_1.6.18+dfsg.orig-tinymce-langs.tar.xz 49949888729c8204636bc14cffcfa003 1928640 web optional roundcube_1.6.18+dfsg.orig-tinymce.tar.xz 8e988bb1541cf388be0bd2630e01dc90 2907948 web optional roundcube_1.6.18+dfsg.orig.tar.xz ec90317e38388b990bb8d2c72ee987d3 158552 web optional roundcube_1.6.18+dfsg-0+deb13u1.debian.tar.xz 44e997bc4fadda5f2d94ebb734ecb806 6268 web optional roundcube_1.6.18+dfsg-0+deb13u1_source.buildinfo -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEERpy6p3b9sfzUdbME05pJnDwhpVIFAmqTSm4ACgkQ05pJnDwh pVKo8A/+Nyd6r3swZL1AuMynQRbvhNUZBsZBFoV+19rNT/UJCFQIS+jgibz9eM9z XZxfn/Tsysr6PC4iTjz3PKNSdMVatC8bv9vi138USazNabDL8oukSz1mYCyab/zY kiQpku9KoY32CFbGOsF++lqq84QEXdqSg+rt+7PVgauyojyAND4FRAk3Ryo7FIam dlNNJ6n9suLpA5AzIKKJU9s6u3PJrG65+4ij/9wBs3IC2n0o5MH0TURYcHnSmFeV uBwOo6NJDkG9siGtj3p9+njZ1n8ouUzjX2Gfyn8tlT7DOSP6ZcAKUCqXCIir7gTm ouJSnT0Unw2bmcGVrJngFZqgOdoaB//8Lgbf/qpQL9cp3Lh2/KJPBYxfCRx990UP O/HirrLikSm5/CUlcHp3N660TvCXHuI+wPJniy4SDzrpFJ+vDFUyGtW/geCHDklq u4ZS1IW5ghxuv0pPiEq4HvmGFx1obBJmiwFShL/C1VCjhg8wb198DCl2I0N5bQ63 yekaRAVFZ0OioC9AsGvuWa1CyTvDZglKz+u+EgmE86Pim/B1XDhSSTR+YrMAP4PH pOKHmuEaTxMCsFGX9NjGQJTglv25qadcrJjnLxK+52e8OuAwkg9IiZTWPKkB6OWk 5oyFoCwOl3bNExmnn3kqANqMkljlwA+ZxutCHjPDbQ6SsTUTouE= =YnPQ -----END PGP SIGNATURE-----
