-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Tue, 20 Oct 2026 07:00:29 +0200
Source: roundcube
Binary: roundcube roundcube-core roundcube-mysql roundcube-pgsql roundcube-plugins roundcube-sqlite3
Architecture: all
Version: 1.6.20+dfsg-0+deb13u1
Distribution: trixie-security
Urgency: high
Maintainer: all / amd64 / i386 Build Daemon (x86-grnet-03) <buildd_amd64-x86-grnet-03@buildd.debian.org>
Changed-By: Guilhem Moulin <guilhem@debian.org>
Description:
 roundcube  - skinnable AJAX based webmail solution for IMAP servers - metapack
 roundcube-core - skinnable AJAX based webmail solution for IMAP servers
 roundcube-mysql - metapackage providing MySQL dependencies for RoundCube
 roundcube-pgsql - metapackage providing PostgreSQL dependencies for RoundCube
 roundcube-plugins - skinnable AJAX based webmail solution for IMAP servers - plugins
 roundcube-sqlite3 - metapackage providing SQLite dependencies for RoundCube
Closes: 1151279
Changes:
 roundcube (1.6.20+dfsg-0+deb13u1) trixie-security; urgency=high
 .
   * New upstream security and bugfix release (closes: #1151279).
     + Fix CVE-2026-113386: IMAP command injection via CRLF in `_uid` parameter
       of mail/headers and mail/viewsource action.
     + Fix bug where an alias login wasn't qualified by IMAP host.
     + Add a size limit to the CSS proxy content processing.
     + Fix SSRF filter (`is_local_url()`) bypass via NAT64 64:ff9b::/96.
     + Fix remote content blocking bypass via SVG SMIL `by` attribute.
     + Fix remote content blocking bypass via CSS escapes in FuncIRI attributes
       (again).
     + Fix passing potentially unsafe attachment content into ImageMagick on
       image resize.
     + Fix mail header injection via the From display-name in the Bounce (resend)
       action.
     + Fix mail header injection via References/In-Reply-To/Message-ID/From
       parameters.
     + Fix object injection primitive in rcube_session::unserialize() via
       “!”-prefixed session keys.
     + Fix ImageMagick resource limits bypass by GD fallback during thumbnail
       generation.
     + Fix CSS scoping bypass in HTML messages using at-rules.
     + Fix bug where deprecated action aliases bypassed `disabled_actions`
       setting.
     + Fix IMAP command injection via CRLF in `_flag` parameter of mail/mark
       action.
     + Fix CSRF validation bypass in the mark-as-junk action.
     + Fix XSS issue in handling of password driver error responses.
     + Fix mail header injection via subject of a message forwarded as
       attachment.
     + Fix mail header injection via media type in an inline image data URI.
     + Fix bug where Password Modoboa driver could change password for another
       account.
     + Fix unsafe use of a login name in SquirrelMail import file path.
   * Refresh d/patches.
Checksums-Sha1:
 ae594ec583b3ed853df3c0df161014b26baf97d5 4497320 roundcube-core_1.6.20+dfsg-0+deb13u1_all.deb
 fa27f25ea57bc487099367760158d78a242d28c7 102916 roundcube-mysql_1.6.20+dfsg-0+deb13u1_all.deb
 b536c5ffcce38f6e810ea2041e012c5219a07627 102880 roundcube-pgsql_1.6.20+dfsg-0+deb13u1_all.deb
 24d8750f35e58d6515801ee815c5854db1ff2295 786672 roundcube-plugins_1.6.20+dfsg-0+deb13u1_all.deb
 4f5654dda2e908610c2a9cddf83bb77b56dc1e9e 102868 roundcube-sqlite3_1.6.20+dfsg-0+deb13u1_all.deb
 5f4fbe9cf05ce8571d6f6c004bdafce95f650b57 14246 roundcube_1.6.20+dfsg-0+deb13u1_all-buildd.buildinfo
 25e8d3d5b5c64c5f942234a873eda313b6a0b303 1288 roundcube_1.6.20+dfsg-0+deb13u1_all.deb
Checksums-Sha256:
 95643a07ea97d1ee162c89b36d3a3b6cee288dc9651cffa4765db8c3495d3c56 4497320 roundcube-core_1.6.20+dfsg-0+deb13u1_all.deb
 2f4fe7fa6f0f343529074bc0f9f2463319216e550ee4311f6967d934b22cd53e 102916 roundcube-mysql_1.6.20+dfsg-0+deb13u1_all.deb
 374b08308f71bfdb35219c33fe45f03c4abac0b1c0e1ffbafbd9c060198e0140 102880 roundcube-pgsql_1.6.20+dfsg-0+deb13u1_all.deb
 fd6d3531dc857e38ab034d5c2585bdfd168e95b15436ce82046498174a6b3d50 786672 roundcube-plugins_1.6.20+dfsg-0+deb13u1_all.deb
 db4a3396e520e3bdb79eb790379bc5a76b7f54dc3d5401cb7d0b53c45083088d 102868 roundcube-sqlite3_1.6.20+dfsg-0+deb13u1_all.deb
 a81c5dde2584c2af5faf589312f1d8846a3e02563908a656d7a98b339833a7be 14246 roundcube_1.6.20+dfsg-0+deb13u1_all-buildd.buildinfo
 9c23f22e6f1cc1d155f9052315e4dc957d6b3d977472b4cf0af727b0d9d14e25 1288 roundcube_1.6.20+dfsg-0+deb13u1_all.deb
Files:
 bd15ece2bb7044436646240fa8de8fab 4497320 web optional roundcube-core_1.6.20+dfsg-0+deb13u1_all.deb
 f7fd2048492e4a27c27bbaafd9c5603f 102916 web optional roundcube-mysql_1.6.20+dfsg-0+deb13u1_all.deb
 495dfa4cbf5d9b959b2ecaa7efe827ed 102880 web optional roundcube-pgsql_1.6.20+dfsg-0+deb13u1_all.deb
 54cdb831f36527a994ea8184781d21c1 786672 web optional roundcube-plugins_1.6.20+dfsg-0+deb13u1_all.deb
 abb6d492cf0a6c5dd4b37f0436b854b6 102868 web optional roundcube-sqlite3_1.6.20+dfsg-0+deb13u1_all.deb
 a5fba666b33d2627a6d35c8695c1189c 14246 web optional roundcube_1.6.20+dfsg-0+deb13u1_all-buildd.buildinfo
 4a97a0a8d73ca45d19501ffc18b1c583 1288 web optional roundcube_1.6.20+dfsg-0+deb13u1_all.deb

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEE5ZI1lXv5WjhHIVjsN8Ugyu9dQiQFAmrYgbEACgkQN8Ugyu9d
QiSH/Q/+L4Jhb4+AJh2iDICou6BuqiXyg1t4X3z3i59qNb/hvvXYsaVQYH2+KYr+
IarLzQEezk3Adkxhq4et7rTSs8m1o2v3f2QQO0q+M2dg3IF0IiII4kKHnf1Be1W8
qcL2jac47DJsqFy4iFTeZgUegPwQayx1RseBlAGLtV6Xv0sbdl4d99nweMJ9c1Mc
wsWAK0Xyxi4+dhv8Qgt3GTFuyi9NuOtdx+9z18WjyeiCDExjsB/DG/iP14Urp7tD
RY8oJ+d0P3DVIKekZMYQaSfgHJHRYggAfn0+tBkV6tHs3QW16//oDGSNCSIOu5D/
wraFOvj0PfZmDdTEoWj4aznuGFxpQXb+j4EPmmFWP9vZoB9dyt0tWh3f81zWgolh
fDAjOWvlvonaLc4DEvWBYO+IGu9a9enlGufA6JHVPzf+UTmXxCb0f/X7Lj25ypz+
/hRadrJ2rmf85E9TNVV1el1v00zw9KMuWAU8pDqN8fy8B87E4LRCzkKhvMZovkXP
3qMP+MN/gYCzJEFI/HBzKdt5dlFp8dx06iOdRg4Y8IZQKO2tLgSJovEGNDy7wVdi
oui+sFulQoIQgreEQr+j3SsV85vBY6qlQ23FHqCyOL5KdUmPfAwCxH1sOVMTqwrt
XbcguKE4ihkU+FNzqDVxgwLuOffttvwZIwrFOyR+FS07Rcw8ncU=
=Nj0M
-----END PGP SIGNATURE-----