-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Mon, 05 Oct 2026 16:08:55 +0200 Source: roundcube Architecture: source Version: 1.6.5+dfsg-1+deb12u12 Distribution: bookworm-security Urgency: high Maintainer: Debian Roundcube Maintainers <pkg-roundcube-maintainers@alioth-lists.debian.net> Changed-By: Guilhem Moulin <guilhem@debian.org> Closes: 1146838 Changes: roundcube (1.6.5+dfsg-1+deb12u12) bookworm-security; urgency=high . * Cherry pick upstream security fixes from v1.6.19 (closes: #1146838): + Fix CSS declaration smuggling via un-encoded ampersand emission. + Fix CSS property injection via body `background` attribute. + Fix email header injection via bare CR in the subject field. + Fix email header injection via C-escape `\r` in the recipient display name. + Fix email header injection via identity's organization field. + Fix zero-click stored XSS via TNEF MIME tag injection in the attachment URL. + Fix XSS in the HTML editor using text/enriched part content. + Fix cross-user access in contact group membership (add/remove) in the SQL address book. + Fix `is_local_url()` bypass via trailing-dot FQDN in stylesheet URL. + Fix remote content blocking bypass via CSS escapes in FuncIRI attributes. + Fix remote-content blocker bypass via SVG SMIL src animation. Checksums-Sha1: 78a25baeff26d55655e2a6b6d8df0b0728edba86 3837 roundcube_1.6.5+dfsg-1+deb12u12.dsc 365f2701f8f9bc568631405f303cb97e186ede9a 266184 roundcube_1.6.5+dfsg-1+deb12u12.debian.tar.xz 63bb9ed8bf06a27e0954ca85c43862d3d2d3dbe0 6633 roundcube_1.6.5+dfsg-1+deb12u12_source.buildinfo Checksums-Sha256: 6cd4c89a64fe18e6eb2cf1915b1442dc840ff7cc5834088bc69c7bbd2cb7840c 3837 roundcube_1.6.5+dfsg-1+deb12u12.dsc 7cae72c19e3c3029a49fbc5f6f75120fe0b4b62d88174062c80965633bb3f6f1 266184 roundcube_1.6.5+dfsg-1+deb12u12.debian.tar.xz 35119f03269ebda8f7fe29c0eda13e62415a04978f171793b29b77e36838276f 6633 roundcube_1.6.5+dfsg-1+deb12u12_source.buildinfo Files: ca28f242a6cd3c2a3a893d1b574e29b3 3837 web optional roundcube_1.6.5+dfsg-1+deb12u12.dsc efca697566785191f4d61086e8454a2c 266184 web optional roundcube_1.6.5+dfsg-1+deb12u12.debian.tar.xz 35e613763564ce4995e0c8d21fe4de36 6633 web optional roundcube_1.6.5+dfsg-1+deb12u12_source.buildinfo -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEERpy6p3b9sfzUdbME05pJnDwhpVIFAmrDz2IACgkQ05pJnDwh pVIbxRAApyUqe6rz+u7CMwZHpv1yqHmr1ZhmAm+RWSIa6S1bc2/6zeMUEJmXn6bv zoFX+cZ29NjUaf6n1c3oS7KU76gfwUpgCqB/Lwqw5te8CGp6Xd9NITI2c0T/Lwkh X0oNNM7hNPOxtSM83fmBcCLBGKfUARJ8c4Qy4SRsBrC/M+nAOAaGM3Iq3pU3AX0b UcUGcXXuNVRx9NG3qo/4V0M/kok3zKVLg3zqeDWE/qakZaFKnoWKdakRZS7EQ5A9 tSBRpj+5cPCjUGxUfog528oB0fVtiLTHO+6Y0Zh1tDjvNjMGfjc4vkKYhQLE1FL/ qb3f7RWJ6ll9uWcHoRNJGoZtiySxm9gHTUtC7wxx/bGCAOcwMgUbpqr7Wd3pFHgy d3jdXGKK5fLADdud84NTYuzeS+0oE0nO7MtQdtt58UrGjNi0mUHkbK6pBUc2cIL2 1iDITd1kg0fhLIRqfw7ySeuvVlmkcmspGpwFQnR9Ul4GEBoqrJ0eXxbPFPwy1Qnx cAsmyxi7X6yLtaB5RF9PgfOmt3br8USeNk/pAps4Sgv1ntUQVMaknJ8baVIjKrOq QolMmCwwKPcpBz1Rc/xq1JKDcbj72TWa8/VH6i9YF3zEdl5s6n24zwxA4TE7QRuz 4qipf0yzsMV/bXm6onmxUF9/redZ85vq6On+7pHWxvlX7nytDhI= =Yzjj -----END PGP SIGNATURE-----
