-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Sun, 06 Sep 2026 13:22:41 +0200 Source: roundcube Architecture: source Version: 1.6.19+dfsg-0+deb13u1 Distribution: trixie-security Urgency: high Maintainer: Debian Roundcube Maintainers <pkg-roundcube-maintainers@alioth-lists.debian.net> Changed-By: Guilhem Moulin <guilhem@debian.org> Closes: 1146838 Changes: roundcube (1.6.19+dfsg-0+deb13u1) trixie-security; urgency=high . * New upstream security and bugfix release (closes: #1146838). + Fix CSS declaration smuggling via un-encoded ampersand emission. + Fix CSS property injection via body `background` attribute. + Fix email header injection via bare CR in the subject field. + Fix email header injection via C-escape `\r` in the recipient display name. + Fix email header injection via identity's organization field. + Fix zero-click stored XSS via TNEF MIME tag injection in the attachment URL. + Fix XSS in the HTML editor using text/enriched part content. + Fix cross-user access in contact group membership (add/remove) in the SQL address book. + Fix `is_local_url()` bypass via trailing-dot FQDN in stylesheet URL. + Fix remote content blocking bypass via CSS escapes in FuncIRI attributes. + Fix remote-content blocker bypass via SVG SMIL src animation. * Refresh d/patches and remove those applied upstream. Checksums-Sha1: abf62dd6b4459360ffeebfdb534b34f991e26857 3860 roundcube_1.6.19+dfsg-0+deb13u1.dsc 42a4a432e26557e1f256016fd70522a3e5fc7dd8 126884 roundcube_1.6.19+dfsg.orig-tinymce-langs.tar.xz f181c2ba04cea59621711962e3553c53e9d9882a 1928432 roundcube_1.6.19+dfsg.orig-tinymce.tar.xz 8c7c229d2ba194dc8dfb1874efb9b1401a786ff1 2910024 roundcube_1.6.19+dfsg.orig.tar.xz 51af771a0b18501a16527b46ca2e1fc06816fc89 158696 roundcube_1.6.19+dfsg-0+deb13u1.debian.tar.xz e1a03051a51563b0d244aa009a19c4f4168ad7df 6633 roundcube_1.6.19+dfsg-0+deb13u1_source.buildinfo Checksums-Sha256: 9e4fc3d1153b54397d74fd0ea4edbe6c3b18ea6f947885ecc004bf85ab5b7e13 3860 roundcube_1.6.19+dfsg-0+deb13u1.dsc 83b2d0ee3e4d937f86d1a8db01deed4c18c1d097a964a3134f9c0748c6eb0dfb 126884 roundcube_1.6.19+dfsg.orig-tinymce-langs.tar.xz d6a37e1987aa5c3b027f916f18ebbb778c38ee3e0cdf236ee88725ab07cdd6f9 1928432 roundcube_1.6.19+dfsg.orig-tinymce.tar.xz 10e6ffaeae68f5aa3d7c41fe5e5c29ca37df500ced8a2b75a0fae66f190050f1 2910024 roundcube_1.6.19+dfsg.orig.tar.xz a3de3cdfe507885459cfce4932b5b6ff1a213af54119d50ae7bc3219db64d6e5 158696 roundcube_1.6.19+dfsg-0+deb13u1.debian.tar.xz 46c42ca65a13c105099d70972a23a7fdc6b282541e2dff82d64c33d6cd6d0d8b 6633 roundcube_1.6.19+dfsg-0+deb13u1_source.buildinfo Files: 26adba7d4bf72a3d6ebcb8b118cad0b3 3860 web optional roundcube_1.6.19+dfsg-0+deb13u1.dsc 8ac2d1ce8d0f3d2979ad98f17a3a5090 126884 web optional roundcube_1.6.19+dfsg.orig-tinymce-langs.tar.xz 92283952d3baebc2b092c1298a7f4c0e 1928432 web optional roundcube_1.6.19+dfsg.orig-tinymce.tar.xz 5d27f90436ad392e742590cc0918a18f 2910024 web optional roundcube_1.6.19+dfsg.orig.tar.xz 20e2aac5f25eec65333982ce073acb66 158696 web optional roundcube_1.6.19+dfsg-0+deb13u1.debian.tar.xz dc22a9f63813ddaafe25d59fc20f8178 6633 web optional roundcube_1.6.19+dfsg-0+deb13u1_source.buildinfo -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEERpy6p3b9sfzUdbME05pJnDwhpVIFAmrD94wACgkQ05pJnDwh pVLa9g//VZBBNRaQINXz9/8PFXfjlENS72pmSiAnTotXsHsX/r6gQDV6HuOu+rUE hgHT2V5ZJXe/CaQfLHodSBIjqf2SdDi/7xADyrsnqSc+Qq4V9on25YSj9J6pyRSA PIixw7TE8a+K+SD9RNGTryXdBVOHBdxDLUA5bh1a2R2RcwswxRT4ozpAyKLm7T1Q uhiP7X8gEHafJ9n58yzXS5iI1UrieZb1uhMP7oTpKhgufVgkOnv5o6ppGPMJejtW gzoECHGrZoadtkGCM7+RzzjJccntQgoJ+XVeKeCMc5y41Vxm+7RnDzJy0IYpepp5 whUjUbYcHbNMj7s8t3+BNfMqc6Ukuf0H7IV0iWuJ0aYcWgsKIYKMKQ33u8xInGBw hS1f2G0I2PLslIv00AVZsR0ba4goEH/FsydCxboFU4IfI1PsdhFrBdH/g16OBLx5 5+gMxGxjyyzN1I3BTHvZ4VXrbvlmd/60nflIt/EOPA1nte177guhKtcnHrVkV+6X J2Yf9xH+gzqtfy3wIFlS6IeFTmZBdzgpFQ/8V1mVoOU/wks7XAV1bc6jAFXY5a2s Th9uNYVb+I+me9fEoEDIKoqo3SQYM5h4RmBwzP96LQ5AlFzXVhX0Tyuur2ZbKis9 tJ5H4vz8+b6HlAMvsP8NsDuIhqRrxx0D3yOr1tbTibH1Bug4GdE= =K6yv -----END PGP SIGNATURE-----
