Debian Package Tracker

general

source: roundcube (main)
version: 1.3.6+dfsg.1-1
maintainer: Debian Roundcube Maintainers (archive) [DMD]
uploaders: Vincent Bernat [DMD] – Guilhem Moulin [DMD] – Sandro Knauß [DMD]
arch: all
std-ver: 4.1.4
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 0.7.2-9+deb7u2
o-o-sec: 0.7.2-9+deb7u9
old-bpo: 1.1.5+dfsg.1-1~bpo8+5
stable: 1.2.3+dfsg.1-4+deb9u1
stable-sec: 1.2.3+dfsg.1-4+deb9u1
testing: 1.3.3+dfsg.1-2
unstable: 1.3.6+dfsg.1-1

versioned links

0.7.2-9+deb7u2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
0.7.2-9+deb7u9: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.1.5+dfsg.1-1~bpo8+5: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.2.3+dfsg.1-4+deb9u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.3.3+dfsg.1-2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.3.6+dfsg.1-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

roundcube
roundcube-core
roundcube-mysql
roundcube-pgsql
roundcube-plugins
roundcube-sqlite3

action needed

Marked for autoremoval on 21 May: #895100 high

Version 1.3.3+dfsg.1-2 of roundcube is marked for autoremoval from testing on Mon 21 May 2018. It is affected by #895100. The removal of roundcube will also cause the removal of (transitive) reverse dependency: roundcube-plugins-extra. You should try to prevent the removal by fixing these RC bugs.

Created: 2018-04-14 Last update: 2018-04-20 02:21

1 security issue in sid high

There is 1 open security issue in sid.

1 important issue:

CVE-2018-1000071: roundcube version 1.3.4 and earlier contains an Insecure Permissions vulnerability in enigma plugin that can result in exfiltration of gpg private key. This attack appear to be exploitable via network connectivity.

Please fix it.

Created: 2018-02-27 Last update: 2018-04-16 08:09

2 security issues in stretch high

There are 2 open security issues in stretch.

1 important issue:

CVE-2018-9846: In Roundcube from versions 1.2.0 to 1.3.5, with the archive plugin enabled and configured, it's possible to exploit the unsanitized, user-controlled "_uid" parameter (in an archive.php _task=mail&_mbox=INBOX&_action=plugin.move2archive request) to perform an MX (IMAP) injection attack by placing an IMAP command after a %0d%0a sequence. NOTE: this is less easily exploitable in 1.3.4 and later because of a Same Origin Policy protection mechanism.

1 issue skipped by the security teams:

CVE-2018-1000071: roundcube version 1.3.4 and earlier contains an Insecure Permissions vulnerability in enigma plugin that can result in exfiltration of gpg private key. This attack appear to be exploitable via network connectivity.

Please fix them.

Created: 2018-02-27 Last update: 2018-04-16 08:09

2 security issues in buster high

There are 2 open security issues in buster.

2 important issues:

CVE-2018-1000071: roundcube version 1.3.4 and earlier contains an Insecure Permissions vulnerability in enigma plugin that can result in exfiltration of gpg private key. This attack appear to be exploitable via network connectivity.
CVE-2018-9846: In Roundcube from versions 1.2.0 to 1.3.5, with the archive plugin enabled and configured, it's possible to exploit the unsanitized, user-controlled "_uid" parameter (in an archive.php _task=mail&_mbox=INBOX&_action=plugin.move2archive request) to perform an MX (IMAP) injection attack by placing an IMAP command after a %0d%0a sequence. NOTE: this is less easily exploitable in 1.3.4 and later because of a Same Origin Policy protection mechanism.

Please fix them.

Created: 2018-02-27 Last update: 2018-04-16 08:09

1 bug tagged patch in the BTS normal

The BTS contains patches fixing 1 bug, consider including or untagging them.

Created: 2017-11-21 Last update: 2018-04-20 01:52

lintian reports 2 warnings normal

Lintian reports 2 warnings about this package. You should make the package lintian clean getting rid of them.

Created: 2018-01-23 Last update: 2018-04-15 07:58

A new version is available in the VCS, consider uploading it. normal

vcswatch reports that this package has a new version ready in the VCS. You should consider uploading into the archive.

Created: 2018-01-19 Last update: 2018-04-15 02:43

2 ignored security issues in wheezy low

There are 2 open security issues in wheezy.

2 issues skipped by the security teams:

CVE-2018-1000071: roundcube version 1.3.4 and earlier contains an Insecure Permissions vulnerability in enigma plugin that can result in exfiltration of gpg private key. This attack appear to be exploitable via network connectivity.
CVE-2013-5645: Multiple cross-site scripting (XSS) vulnerabilities in Roundcube webmail before 0.9.3 allow user-assisted remote attackers to inject arbitrary web script or HTML via the body of a message visited in (1) new or (2) draft mode, related to compose.inc; and (3) might allow remote authenticated users to inject arbitrary web script or HTML via an HTML signature, related to save_identity.inc.

Please fix them.

Created: 2015-07-12 Last update: 2018-04-16 08:09

testing migrations

excuses:
- 5 days old (5 needed)
- Updating roundcube fixes old bugs: #895100
- Piuparts tested OK - https://piuparts.debian.org/sid/source/r/roundcube.html

news

[rss feed]

[2018-04-14] Accepted roundcube 1.3.6+dfsg.1-1 (source all) into unstable (Guilhem Moulin)
[2017-11-28] Accepted roundcube 0.7.2-9+deb7u9 (source all) into oldoldstable (Roberto C. Sanchez)
[2017-11-25] roundcube 1.3.3+dfsg.1-2 MIGRATED to testing (Debian testing watch)
[2017-11-20] Accepted roundcube 1.3.3+dfsg.1-2 (source all) into unstable (Guilhem Moulin)
[2017-11-12] Accepted roundcube 1.2.3+dfsg.1-4+deb9u1 (source all) into proposed-updates->stable-new, proposed-updates (Guilhem Moulin)
[2017-11-11] roundcube 1.3.3+dfsg.1-1 MIGRATED to testing (Debian testing watch)
[2017-11-09] Accepted roundcube 1.3.3+dfsg.1-1 (source all) into unstable (Guilhem Moulin)
[2017-09-16] roundcube 1.3.1+dfsg.1-1 MIGRATED to testing (Debian testing watch)
[2017-09-10] Accepted roundcube 1.3.1+dfsg.1-1 (source) into unstable (Sandro Knauß)
[2017-08-28] roundcube 1.3.0+dfsg.1-1 MIGRATED to testing (Debian testing watch)
[2017-08-22] Accepted roundcube 1.3.0+dfsg.1-1 (source) into unstable (Sandro Knauß)
[2017-07-27] Accepted roundcube 0.7.2-9+deb7u8 (source all) into oldoldstable (Markus Koschany)
[2017-06-06] Accepted roundcube 1.1.5+dfsg.1-1~bpo8+5 (source all) into jessie-backports->backports-policy, jessie-backports (Guilhem Moulin) (signed by: Vincent Bernat)
[2017-05-12] roundcube 1.2.3+dfsg.1-4 MIGRATED to testing (Debian testing watch)
[2017-05-07] Accepted roundcube 0.7.2-9+deb7u7 (source all) into oldstable (Markus Koschany)
[2017-05-02] Accepted roundcube 1.2.3+dfsg.1-4 (source all) into unstable (Guilhem Moulin) (signed by: Vincent Bernat)
[2017-03-17] roundcube 1.2.3+dfsg.1-3 MIGRATED to testing (Debian testing watch)
[2017-03-14] Accepted roundcube 1.1.5+dfsg.1-1~bpo8+4 (source all) into jessie-backports->backports-policy, jessie-backports (Guilhem Moulin) (signed by: Vincent Bernat)
[2017-03-14] Accepted roundcube 1.2.3+dfsg.1-3 (source all) into unstable (Guilhem Moulin) (signed by: Vincent Bernat)
[2017-03-14] Accepted roundcube 1.2.3+dfsg.1-2 (source all) into unstable (Guilhem Moulin) (signed by: Vincent Bernat)
[2017-03-13] Accepted roundcube 0.7.2-9+deb7u6 (source all) into oldstable (Markus Koschany)
[2016-12-27] roundcube 1.2.3+dfsg.1-1 MIGRATED to testing (Debian testing watch)
[2016-12-16] Accepted roundcube 1.2.3+dfsg.1-1 (source) into unstable (Sandro Knauß)
[2016-12-08] Accepted roundcube 0.7.2-9+deb7u5 (source all) into oldstable (Chris Lamb)
[2016-12-07] Accepted roundcube 1.1.5+dfsg.1-1~bpo8+2 (source all) into jessie-backports (Guilhem Moulin) (signed by: Vincent Bernat)
[2016-10-24] roundcube 1.2.2+dfsg.1-1 MIGRATED to testing (Debian testing watch)
[2016-10-16] Accepted roundcube 1.2.2+dfsg.1-1 (source) into unstable (Sandro Knauß)
[2016-09-08] Accepted roundcube 0.7.2-9+deb7u4 (source all) into oldstable (Raphaël Hertzog)
[2016-08-11] roundcube 1.2.1+dfsg.1-2 MIGRATED to testing (Debian testing watch)
[2016-08-05] Accepted roundcube 1.2.1+dfsg.1-2 (source) into unstable (Sandro Knauß)

bugs [bug history graph]

all: 20
RC: 0
I&N: 14
M&W: 6
F&P: 0

links

homepage
lintian (0, 2)
buildd: logs, clang, reproducibility
popcon
browse source code
edit tags
security tracker
screenshots

ubuntu

[Information about Ubuntu for Debian Developers]

version: 1.3.6+dfsg.1-1
59 bugs