-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Tue, 20 Oct 2026 07:00:29 +0200 Source: roundcube Architecture: source Version: 1.6.20+dfsg-0+deb13u1 Distribution: trixie-security Urgency: high Maintainer: Debian Roundcube Maintainers <pkg-roundcube-maintainers@alioth-lists.debian.net> Changed-By: Guilhem Moulin <guilhem@debian.org> Closes: 1151279 Changes: roundcube (1.6.20+dfsg-0+deb13u1) trixie-security; urgency=high . * New upstream security and bugfix release (closes: #1151279). + Fix CVE-2026-113386: IMAP command injection via CRLF in `_uid` parameter of mail/headers and mail/viewsource action. + Fix bug where an alias login wasn't qualified by IMAP host. + Add a size limit to the CSS proxy content processing. + Fix SSRF filter (`is_local_url()`) bypass via NAT64 64:ff9b::/96. + Fix remote content blocking bypass via SVG SMIL `by` attribute. + Fix remote content blocking bypass via CSS escapes in FuncIRI attributes (again). + Fix passing potentially unsafe attachment content into ImageMagick on image resize. + Fix mail header injection via the From display-name in the Bounce (resend) action. + Fix mail header injection via References/In-Reply-To/Message-ID/From parameters. + Fix object injection primitive in rcube_session::unserialize() via “!”-prefixed session keys. + Fix ImageMagick resource limits bypass by GD fallback during thumbnail generation. + Fix CSS scoping bypass in HTML messages using at-rules. + Fix bug where deprecated action aliases bypassed `disabled_actions` setting. + Fix IMAP command injection via CRLF in `_flag` parameter of mail/mark action. + Fix CSRF validation bypass in the mark-as-junk action. + Fix XSS issue in handling of password driver error responses. + Fix mail header injection via subject of a message forwarded as attachment. + Fix mail header injection via media type in an inline image data URI. + Fix bug where Password Modoboa driver could change password for another account. + Fix unsafe use of a login name in SquirrelMail import file path. * Refresh d/patches. Checksums-Sha1: a0a03bd91aa0a453fce1b0fe81640b2e3e991ee0 3860 roundcube_1.6.20+dfsg-0+deb13u1.dsc 32a740c50ee6ae83c79d675e539d9bb4ff86ca19 126856 roundcube_1.6.20+dfsg.orig-tinymce-langs.tar.xz c17351cead238baa4a63bce2b136ff054c2034f9 1928744 roundcube_1.6.20+dfsg.orig-tinymce.tar.xz d6cb3e64e6cef16458b627130240c0e7e88b7536 2921204 roundcube_1.6.20+dfsg.orig.tar.xz edd75d5f492f832d17bc7651d442b81b18b7c0e4 159268 roundcube_1.6.20+dfsg-0+deb13u1.debian.tar.xz 3e6098a85573a04218818f1003cc7dcc40fb39ac 6734 roundcube_1.6.20+dfsg-0+deb13u1_source.buildinfo Checksums-Sha256: 9e5652f65efed5c66c87c929b71c4e423866e49dcee0ed69a9810b669b020fa1 3860 roundcube_1.6.20+dfsg-0+deb13u1.dsc b7968a5dd8a32fdbde4afd733111a6fd44cbfa346332bd07e4dcf2c5b09007cf 126856 roundcube_1.6.20+dfsg.orig-tinymce-langs.tar.xz 5f0d2f90355cd16d94d6be3e857995be0c4bad6b96cde894815901577eba5c34 1928744 roundcube_1.6.20+dfsg.orig-tinymce.tar.xz fa1b308c9e3169776321b80af6f1831329b1947a515a024fe9032e31055c3b39 2921204 roundcube_1.6.20+dfsg.orig.tar.xz ebcd742800aff6baed866d2fd2b71a7b078e92b0ab0d9ea260df3bdef0e6dd18 159268 roundcube_1.6.20+dfsg-0+deb13u1.debian.tar.xz e753bd947e230d50d76f7d805381f88db5d4ac2dae1e21084d90787cc33dbf3e 6734 roundcube_1.6.20+dfsg-0+deb13u1_source.buildinfo Files: 133edf32ba197c0740e7581a99b8c77c 3860 web optional roundcube_1.6.20+dfsg-0+deb13u1.dsc 9f448ec4c449b2c7a9af1544112ef559 126856 web optional roundcube_1.6.20+dfsg.orig-tinymce-langs.tar.xz c7276aef6d00b70deda0abf66bc2e050 1928744 web optional roundcube_1.6.20+dfsg.orig-tinymce.tar.xz a7ab89080eb8e14bc5433bbd30b05120 2921204 web optional roundcube_1.6.20+dfsg.orig.tar.xz 6f9acb638292ccedde2dfbf78a7caa2c 159268 web optional roundcube_1.6.20+dfsg-0+deb13u1.debian.tar.xz 7dbfcd846cd83138e547acf750a386af 6734 web optional roundcube_1.6.20+dfsg-0+deb13u1_source.buildinfo -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEERpy6p3b9sfzUdbME05pJnDwhpVIFAmrYeC8ACgkQ05pJnDwh pVLusw/9E0/NKOnaOak79G+0fdJgXf/LTK6mMNRwoxqOlmMonSCa2qQdwu2pdN18 XRfGtRloDkQdb4MKoDmTRQ87imp/4TkLyCxbvs+bhwoS/y9U37HQXn0rFuSBxlzV ciEw2mUuHl4t3sWknEhcTHTDYk6XwObaTBsM7XMieyMxVsBYuYAQRAC8fv3JXWH7 gHTU+5Xe8M90xYwl912uDtGqBPDq1nFLww0n60LmriRQtRoghmIjMivtB7N96Ybh zRlOCue71bQsdmYj/3SCumBaIZMlKwTfd8kZ0Rpfw2kqDtlvU4Ko4p9wU6ot9ery ii92r6GWQxRY+CWHjyB582UqvsAB4cSC/4SCAXCikwlUE200eU7oxMOxMyN47hQP 1ixlu4sQjYv34JaSLgFfvWZxQHIsCVFRN3bcW+PMBB5FF52ITC4HcUoO2T4eESC2 +YRIAbdqvlaWd2ACFmM+zxPnEBTEEZesH3nSQ9ENGYfffto4+vOHUOzF+y7HZ6n8 TCRRJogPL1XemBAO1gCUSr0fljfRTytJrO5fkP6uCdc4ZNA1T0pzzMA5FjEa9JD1 aooWBL3URQugJpodIAh/SIX8zOi6gG/a29o11mD+nqulJuoRNjPwNbnhh9GHOAdz Wljk9P/JqkA/Z8ViuqBUh2sW7SAsfrhC4HbOF4i+Lw06E/R0eOs= =YPW2 -----END PGP SIGNATURE-----
