-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Mon, 10 Aug 2026 15:45:10 +0200 Source: roundcube Binary: roundcube roundcube-core roundcube-mysql roundcube-pgsql roundcube-plugins roundcube-sqlite3 Architecture: all Version: 1.6.18+dfsg-0+deb13u1 Distribution: trixie-security Urgency: high Maintainer: all Build Daemon (x86-csail-02) Changed-By: Guilhem Moulin Description: roundcube - skinnable AJAX based webmail solution for IMAP servers - metapack roundcube-core - skinnable AJAX based webmail solution for IMAP servers roundcube-mysql - metapackage providing MySQL dependencies for RoundCube roundcube-pgsql - metapackage providing PostgreSQL dependencies for RoundCube roundcube-plugins - skinnable AJAX based webmail solution for IMAP servers - plugins roundcube-sqlite3 - metapackage providing SQLite dependencies for RoundCube Closes: 1144059 Changes: roundcube (1.6.18+dfsg-0+deb13u1) trixie-security; urgency=high . * New upstream security and bugfix release (closes: #1144059). + Fix CVE-2026-74998: Content proxied by the css proxy is not validated validation. + Fix CVE-2026-75006: SSRF bypass via specific local address URLs using 100.64.0.0/10 and fe80::/10 subnets. + Fix CVE-2026-75006: SSRF filter bypass via various forms of nip.io/sslip.io hostnames evading `is_local_url()` check. + Fix CVE-2026-75003: Remote content blocking bypass via unclosed `url()` in a FuncIRI attribute. + Fix CVE-2026-75007: LDAP filter injection via unescaped %u/%fu/%d substitution into the `search_filter`. + Fix CVE-2026-75004: Arbitrary sieve script injection via a filter rule name bypassing `managesieve_disabled_actions`. + Fix CVE-2026-74997: RCE in the `cmd_learn` driver of markasjunk plugin. + Fix CVE-2026-75002: IMAP command injection via mail search and LITERAL+ byte-count desynchronization. + Fix CVE-2026-75010: The modoboa driver of the passwd plugin leaks an authentication token to a user-controlled host. + Fix CVE-2026-74999: Stored XSS in "Add to address book" action. + Fix CVE-2026-75000: HTML/CSS sanitization bypass via SVG animate `by` attribute. * Refresh d/patches. * Cherry-pick follow-up change to fix PHP warning in markasjunk's cmd_learn.php. Checksums-Sha1: 6f582a72fb17388a94b5df7a465aa56e811c92bb 4493664 roundcube-core_1.6.18+dfsg-0+deb13u1_all.deb c5d5b7495f3b26dacf33b275c4e4281bff9c74aa 101388 roundcube-mysql_1.6.18+dfsg-0+deb13u1_all.deb 7702fa1038d63b30400ff86c1af7d11e959a7ebe 101364 roundcube-pgsql_1.6.18+dfsg-0+deb13u1_all.deb 614bee61297412b6625ea0825d34d645fdba3c96 784872 roundcube-plugins_1.6.18+dfsg-0+deb13u1_all.deb 5d58fe2986e3512b49e58d980e6e78e62b0fdcaa 101340 roundcube-sqlite3_1.6.18+dfsg-0+deb13u1_all.deb 487f8f454a1255a6507a8652fd47f0ad0b278482 14183 roundcube_1.6.18+dfsg-0+deb13u1_all-buildd.buildinfo 53bc91e90de8daac911cc3dd723ede4ebe8479d3 1296 roundcube_1.6.18+dfsg-0+deb13u1_all.deb Checksums-Sha256: 3bdf7d93e5120aca20604a7a9ebe9a71f14dbce35a73c43e8e8734f55b6f68e7 4493664 roundcube-core_1.6.18+dfsg-0+deb13u1_all.deb f1e82120331cfb4e42ee5fbee8f94359319e1fd95d05669ee67c60ff58d413d0 101388 roundcube-mysql_1.6.18+dfsg-0+deb13u1_all.deb f58169e98f239e4226c5fbed4822473096a7d4781ac0c5d5f901f369e27d774c 101364 roundcube-pgsql_1.6.18+dfsg-0+deb13u1_all.deb 760db9839195447d85178006635983100e675d39a42d3549739c1919c47b5836 784872 roundcube-plugins_1.6.18+dfsg-0+deb13u1_all.deb 61a1f0ca7a6946391187a348f535a7d05a642c2f720489a3be297ebd553de66f 101340 roundcube-sqlite3_1.6.18+dfsg-0+deb13u1_all.deb 3cb9f8d207a4545fb30ddb026f0d5350672aec1ff8e4dbabc73411232e8a5de3 14183 roundcube_1.6.18+dfsg-0+deb13u1_all-buildd.buildinfo 5ed445138cf068ac399fcfbdf82ec8af854e8784d8cf35b7a92d9f31310f6e0e 1296 roundcube_1.6.18+dfsg-0+deb13u1_all.deb Files: 3f29701b4ca287575db700e4fc02668f 4493664 web optional roundcube-core_1.6.18+dfsg-0+deb13u1_all.deb d0ebc93a43eccd8d080004369a496ced 101388 web optional roundcube-mysql_1.6.18+dfsg-0+deb13u1_all.deb 5eb3598920fc9c45f13cf081f8d23539 101364 web optional roundcube-pgsql_1.6.18+dfsg-0+deb13u1_all.deb f88289e13d12a2bb148e7b7f0d64bbe1 784872 web optional roundcube-plugins_1.6.18+dfsg-0+deb13u1_all.deb 9e46c15361ecc928948b2d96ca6fdce4 101340 web optional roundcube-sqlite3_1.6.18+dfsg-0+deb13u1_all.deb 7c48538e6ca3c2b2a59bf378b8e91f4d 14183 web optional roundcube_1.6.18+dfsg-0+deb13u1_all-buildd.buildinfo 0a32b1e7d5fc3380305671e00994747b 1296 web optional roundcube_1.6.18+dfsg-0+deb13u1_all.deb -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEXLxUpUHQBQBTDtd4aBVi67oXtfkFAmqTT38ACgkQaBVi67oX tfkWRA/+MmvW2ywd+dAvLSp/ki1lwdqV35qlL5BQTgWxvyoE1eSCA65C7mkM9C6m AUW0QT6Kg1yQeZNkI9bgM+DDnE2LRqX8M4PcMc0qmHHdMnA/gRgTHuxWBlU0aFXu vJ+VkbuXXMjFqV/UfJguowrfXckELa84Tv1BdfYFofN1L8lm28IKVZfsaE/NO81I fm/NBlIX4IIljgRC0M4MGz6eb61/yCsaX5gu1bJYzaQ6Ajja8ltSE/GQ3KTXvz7s PEZbSrV/3xUAftpDmIzLWj+yJdnuQXoCIXUsJ3pv4PYICdg6CoQIc9IMGLdqqn7h OHsP6UQ5IPDCa5kpdVvGrg/cmoled98mvTNUVlPBPO5PTuQXdr8vb6de62oVabTf MX7Y82Eb9tstdlj2DT1+igzKFIIUCUgw7qxyU8bzC/HsBYruiPAvZOJJzscOg8q5 q5LAq9yoY2edToYF+NEkCGi+/6KC7mAGxcP9RPC9XzSOnrSecFnnO+Qt4D52NQxU T+rQcfG9TKAPRysOpdzkfEhw/93LBCSWs2JMbiIgo76QNfsLJhl/5lqLVlm8jPc5 zj3UzMUMpNo4q9SnLyam/0OdAq4Y5h3nB6JTSzFgZlTEVVC5Pyvi6Joo8J9qCByU IUsHg+MNNRf0MHmkHYC9yAYCIJ7PLoRDnOR6R2o+75ycPPj+FZk= =KvHZ -----END PGP SIGNATURE-----