-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Sun, 06 Sep 2026 11:50:58 +0200 Source: roundcube Architecture: source Version: 1.6.19+dfsg-1 Distribution: unstable Urgency: medium Maintainer: Debian Roundcube Maintainers <pkg-roundcube-maintainers@alioth-lists.debian.net> Changed-By: Guilhem Moulin <guilhem@debian.org> Closes: 1146838 Changes: roundcube (1.6.19+dfsg-1) unstable; urgency=medium . * New upstream security and bugfix release (closes: #1146838). + Fix CSS declaration smuggling via un-encoded ampersand emission. + Fix CSS property injection via body `background` attribute. + Fix email header injection via bare CR in the subject field. + Fix email header injection via C-escape `\r` in the recipient display name. + Fix email header injection via identity's organization field. + Fix zero-click stored XSS via TNEF MIME tag injection in the attachment URL. + Fix XSS in the HTML editor using text/enriched part content. + Fix cross-user access in contact group membership (add/remove) in the SQL address book. + Fix `is_local_url()` bypass via trailing-dot FQDN in stylesheet URL. + Fix remote content blocking bypass via CSS escapes in FuncIRI attributes. + Fix remote-content blocker bypass via SVG SMIL src animation. * Refresh d/patches and remove those applied upstream. * Bump debhelper compatibility level to 14 (no changes necessary). Checksums-Sha1: 464ea642b1482891a047cb17bf7ad34bc0a8f65e 3845 roundcube_1.6.19+dfsg-1.dsc 42a4a432e26557e1f256016fd70522a3e5fc7dd8 126884 roundcube_1.6.19+dfsg.orig-tinymce-langs.tar.xz f181c2ba04cea59621711962e3553c53e9d9882a 1928432 roundcube_1.6.19+dfsg.orig-tinymce.tar.xz 8c7c229d2ba194dc8dfb1874efb9b1401a786ff1 2910024 roundcube_1.6.19+dfsg.orig.tar.xz 13d4f75ad1ed1be248c372759322d1acb44129fb 160184 roundcube_1.6.19+dfsg-1.debian.tar.xz 4589269843b69e0358f7e4d288a3af88104677a5 6646 roundcube_1.6.19+dfsg-1_source.buildinfo Checksums-Sha256: 74d6d446c376cc65a1dd2568b0c10a0b4c29a067de5e6d44fff3d7212027ad19 3845 roundcube_1.6.19+dfsg-1.dsc 83b2d0ee3e4d937f86d1a8db01deed4c18c1d097a964a3134f9c0748c6eb0dfb 126884 roundcube_1.6.19+dfsg.orig-tinymce-langs.tar.xz d6a37e1987aa5c3b027f916f18ebbb778c38ee3e0cdf236ee88725ab07cdd6f9 1928432 roundcube_1.6.19+dfsg.orig-tinymce.tar.xz 10e6ffaeae68f5aa3d7c41fe5e5c29ca37df500ced8a2b75a0fae66f190050f1 2910024 roundcube_1.6.19+dfsg.orig.tar.xz dff5dc5c08ffb9539ce790f88523aefc37e2633b29479f19bc4e2ba879bcd71c 160184 roundcube_1.6.19+dfsg-1.debian.tar.xz 2be1fb55aa99c12b8aaaa7901caaeea0aa46a8f72419f040d48c23c180309c08 6646 roundcube_1.6.19+dfsg-1_source.buildinfo Files: e8a71b2daab60f2093d8500cc2a8dd4c 3845 web optional roundcube_1.6.19+dfsg-1.dsc 8ac2d1ce8d0f3d2979ad98f17a3a5090 126884 web optional roundcube_1.6.19+dfsg.orig-tinymce-langs.tar.xz 92283952d3baebc2b092c1298a7f4c0e 1928432 web optional roundcube_1.6.19+dfsg.orig-tinymce.tar.xz 5d27f90436ad392e742590cc0918a18f 2910024 web optional roundcube_1.6.19+dfsg.orig.tar.xz 95be6ab5708eb4063762df025f170946 160184 web optional roundcube_1.6.19+dfsg-1.debian.tar.xz f6fe37aeb331940fd911fd7282815968 6646 web optional roundcube_1.6.19+dfsg-1_source.buildinfo -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEERpy6p3b9sfzUdbME05pJnDwhpVIFAmqdfiEACgkQ05pJnDwh pVIXJA/+OEefeNc1YypThImPpB9OZ7JBqSTOEC9qTZz8Le+ZjzUGFcJcWbls2/NO vjAiAq8YCJH7ntbChka6IkEyiiRho2o8e6YTsjdw2TmFKhRrv+65i9Ja9MxoiXua 33uxpdJjSq2+4MlpY+rTuZ8iND8HQk3QtpeAD+7kdyRpmO4Y97gHB/Osovg0YGls TSgKpVvr7REpgcBWaee0tcehMGWuM4x7uKmaQTMiC5qdUgntylsbG+XBQRPXOy4o Kt49JdfD7HSM1Us3F74+rPnsWrAlAl5gIOh2VcW2Kqc3iz4HCCJfOpnoNj52Zffg WZzQxdtW1EP5nH4qk8k4Q94K6e7OVVjc/IdZvJQnfWp2sTD0FqdAfb+BiF5msAK9 agtYJNWfAtWSaJQ99+YByFIeYAWkJjmqKQGirzFMAm11RSotEvKLWPyHSMTCbAmw ThzmqMG9HcaDsTNymAxeKil35oS9SRJs5pOeN0cJKTqPvyLnAaVSiOiUQhDvGbS3 SGBsmxyqdESROFqehdPqFEWQPCGDiMlazw5GCVYUhI2zjTKpyfoJcQl4cpsY+gSX ccAImUKzrge0KByJKPVZsSl57U8xs+rzQt3sETmZnK0PSPMW24bB6MvJjSXpulOZ BPobTNP27sxpSc0p1I0YkKO+kED73kqlZb6yE1VNSMlWbSf1e0E= =NMMt -----END PGP SIGNATURE-----
