-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Mon, 19 Oct 2026 16:51:01 +0200 Source: roundcube Architecture: source Version: 1.6.20+dfsg-1 Distribution: unstable Urgency: medium Maintainer: Debian Roundcube Maintainers <pkg-roundcube-maintainers@alioth-lists.debian.net> Changed-By: Guilhem Moulin <guilhem@debian.org> Closes: 1151279 Changes: roundcube (1.6.20+dfsg-1) unstable; urgency=medium . * New upstream security and bugfix release (closes: #1151279). + Fix IMAP command injection via CRLF in `_uid` parameter of mail/headers and mail/viewsource action. + Fix bug where an alias login wasn't qualified by IMAP host. + Add a size limit to the CSS proxy content processing. + Fix SSRF filter (is_local_url()) bypass via NAT64 64:ff9b::/96. + Fix remote content blocking bypass via SVG SMIL `by` attribute. + Fix remote content blocking bypass via CSS escapes in FuncIRI attributes (again). + Fix passing potentially unsafe attachment content into ImageMagick on image resize. + Fix mail header injection via the From display-name in the Bounce (resend) action. + Fix mail header injection via References/In-Reply-To/Message-ID/From parameters. + Fix object injection primitive in rcube_session::unserialize() via “!”-prefixed session keys. + Fix ImageMagick resource limits bypass by GD fallback during thumbnail generation. + Fix CSS scoping bypass in HTML messages using at-rules. + Fix bug where deprecated action aliases bypassed `disabled_actions` setting. + Fix IMAP command injection via CRLF in `_flag` parameter of mail/mark action. + Fix CSRF validation bypass in the mark-as-junk action. + Fix XSS issue in handling of password driver error responses. + Fix mail header injection via subject of a message forwarded as attachment. + Fix mail header injection via media type in an inline image data URI. + Fix bug where Password Modoboa driver could change password for another account. + Fix unsafe use of a login name in SquirrelMail import file path. * Remove `Depends: ${misc:Depends}` from the binary packages. * Refresh d/roundcube-core.lintian-overrides. Checksums-Sha1: 15788fa9018782f7800dd4e7c280a22f82d2f4cf 3845 roundcube_1.6.20+dfsg-1.dsc 32a740c50ee6ae83c79d675e539d9bb4ff86ca19 126856 roundcube_1.6.20+dfsg.orig-tinymce-langs.tar.xz c17351cead238baa4a63bce2b136ff054c2034f9 1928744 roundcube_1.6.20+dfsg.orig-tinymce.tar.xz d6cb3e64e6cef16458b627130240c0e7e88b7536 2921204 roundcube_1.6.20+dfsg.orig.tar.xz 12748f310f554dda71c7ff9eb85ee3c8fd57c223 160736 roundcube_1.6.20+dfsg-1.debian.tar.xz d5074c57b5ce2b37285b8d638a43fac0b0679d71 6606 roundcube_1.6.20+dfsg-1_source.buildinfo Checksums-Sha256: ad49d6e2c5b2456fd1181965d6e2d95b791550fb1fd49f5a8594c5b7db0f0286 3845 roundcube_1.6.20+dfsg-1.dsc b7968a5dd8a32fdbde4afd733111a6fd44cbfa346332bd07e4dcf2c5b09007cf 126856 roundcube_1.6.20+dfsg.orig-tinymce-langs.tar.xz 5f0d2f90355cd16d94d6be3e857995be0c4bad6b96cde894815901577eba5c34 1928744 roundcube_1.6.20+dfsg.orig-tinymce.tar.xz fa1b308c9e3169776321b80af6f1831329b1947a515a024fe9032e31055c3b39 2921204 roundcube_1.6.20+dfsg.orig.tar.xz 67eb7e731cd90162e0c4e094c6479ffc58c78b3482452c50e7ed194a5e957b7f 160736 roundcube_1.6.20+dfsg-1.debian.tar.xz 9983c4c0dceb08ac00793e7647c0260c2d85681693ad48f776404b6bde523e44 6606 roundcube_1.6.20+dfsg-1_source.buildinfo Files: 2b50841dc93f7b8d5f4e129b8816c61c 3845 web optional roundcube_1.6.20+dfsg-1.dsc 9f448ec4c449b2c7a9af1544112ef559 126856 web optional roundcube_1.6.20+dfsg.orig-tinymce-langs.tar.xz c7276aef6d00b70deda0abf66bc2e050 1928744 web optional roundcube_1.6.20+dfsg.orig-tinymce.tar.xz a7ab89080eb8e14bc5433bbd30b05120 2921204 web optional roundcube_1.6.20+dfsg.orig.tar.xz 4b02718efe18e2ffffbe2193f630da79 160736 web optional roundcube_1.6.20+dfsg-1.debian.tar.xz c94235c8487a69860e3762d710f6a96e 6606 web optional roundcube_1.6.20+dfsg-1_source.buildinfo -----BEGIN PGP SIGNATURE----- iQIyBAEBCgAdFiEERpy6p3b9sfzUdbME05pJnDwhpVIFAmrWPoEACgkQ05pJnDwh pVI7Ug/4zojdCk8ECAJ0ebvX7Rq6bCzGvUF/05TZnw+VlFnTrDnB1lUrR4eK8SPG Fn+6Vg8DzyqFdl5wsb4QGCdjGhzKdOOGW9QifKa2lbkN6fGbYIM4Q8CEDMr3jn1g aUbYzl94LA1MBdpr+SZrq1U8TpnR2r9NHvP7OckqRR8gN7SjdS37PiH36+8DsC5I 58YQm4jgH1NekIBRlFbysicyuHJMqe3KbEI1rZQ+s2QS0fDFyokfond9PGj1CP9e J7pH5/0yU2OJS0Yw1GErqbt7Z1rW4hNXCujmSORT2UYQ2sAuKX3SdKbvvUQMPZZN l68u9T06OjDxEZQVVRucRQkUDROp4t98vA6r+uVnHlfOV4L0NwpKyIYdhc5i64j4 Ph8Z7ViDgn022QbZNfaX9sWEUO7du/lPU03eFBjYKXU74UdDEvlZp5HE280W/uJd lUaWveT1dpMRo4SiLRDbelVSfvbzeguc2el7UKMpIj7H/vk2txyMY5AKz/FboQEE E5YxkUJ+ncuc4qPzQsgenYbbcpUjXG3O+a3/PbRJn99gKrxIiGY9T4r+KRdxBbAd L7zvBcaEDIzWlwPlwlYbtHreMizCd2glmivDQPtAIOXblUoq3m1frpS0Gm+Tubwm bgTalwF5Zfh9ktQxGpc/5WTxcd4wITSGkpwxHkZq0oPmgvo8/A== =eGBZ -----END PGP SIGNATURE-----
