-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Sun, 06 Sep 2026 13:22:41 +0200
Source: roundcube
Binary: roundcube roundcube-core roundcube-mysql roundcube-pgsql roundcube-plugins roundcube-sqlite3
Architecture: all
Version: 1.6.19+dfsg-0+deb13u1
Distribution: trixie-security
Urgency: high
Maintainer: all Build Daemon (x86-grnet-02) <buildd_all-x86-grnet-02@buildd.debian.org>
Changed-By: Guilhem Moulin <guilhem@debian.org>
Description:
 roundcube  - skinnable AJAX based webmail solution for IMAP servers - metapack
 roundcube-core - skinnable AJAX based webmail solution for IMAP servers
 roundcube-mysql - metapackage providing MySQL dependencies for RoundCube
 roundcube-pgsql - metapackage providing PostgreSQL dependencies for RoundCube
 roundcube-plugins - skinnable AJAX based webmail solution for IMAP servers - plugins
 roundcube-sqlite3 - metapackage providing SQLite dependencies for RoundCube
Closes: 1146838
Changes:
 roundcube (1.6.19+dfsg-0+deb13u1) trixie-security; urgency=high
 .
   * New upstream security and bugfix release (closes: #1146838).
     + Fix CSS declaration smuggling via un-encoded ampersand emission.
     + Fix CSS property injection via body `background` attribute.
     + Fix email header injection via bare CR in the subject field.
     + Fix email header injection via C-escape `\r` in the recipient display
       name.
     + Fix email header injection via identity's organization field.
     + Fix zero-click stored XSS via TNEF MIME tag injection in the attachment
       URL.
     + Fix XSS in the HTML editor using text/enriched part content.
     + Fix cross-user access in contact group membership (add/remove) in the
       SQL address book.
     + Fix `is_local_url()` bypass via trailing-dot FQDN in stylesheet URL.
     + Fix remote content blocking bypass via CSS escapes in FuncIRI
       attributes.
     + Fix remote-content blocker bypass via SVG SMIL src animation.
   * Refresh d/patches and remove those applied upstream.
Checksums-Sha1:
 f0071ed92841e9f1e89dacc844c26370a4970ac0 4494924 roundcube-core_1.6.19+dfsg-0+deb13u1_all.deb
 ff6c610c4c2b7968934326f0b23c801c70c52fb6 101924 roundcube-mysql_1.6.19+dfsg-0+deb13u1_all.deb
 696d38fd1af16a6c9c264fd68f7bafdff363cbc5 101900 roundcube-pgsql_1.6.19+dfsg-0+deb13u1_all.deb
 4fb8e8b70e96b6288ca3814b1334f77b40028771 785468 roundcube-plugins_1.6.19+dfsg-0+deb13u1_all.deb
 a278533bebeeac57aa6417846c322ba772f369e1 101876 roundcube-sqlite3_1.6.19+dfsg-0+deb13u1_all.deb
 cc55e5a16ba29974eb3cc142da7247e92950ca6d 14246 roundcube_1.6.19+dfsg-0+deb13u1_all-buildd.buildinfo
 1d888233c02627b9865370cff2121f2dc0dd4966 1292 roundcube_1.6.19+dfsg-0+deb13u1_all.deb
Checksums-Sha256:
 2c8ad54c9da1a339b07e135f9dfc4be88d719acd77d2e2c9b7dd1b5972386684 4494924 roundcube-core_1.6.19+dfsg-0+deb13u1_all.deb
 37cbc8a850605b8633e786ef2883d660cfe5fb919ca1d33332a8fb42c83c42b9 101924 roundcube-mysql_1.6.19+dfsg-0+deb13u1_all.deb
 669b424c794127cf3560d9fec85efcc1c8d7cdd52aad9aad2611ebe686370f54 101900 roundcube-pgsql_1.6.19+dfsg-0+deb13u1_all.deb
 1b03f0277c7343112e4a6efcec27cbd4f052ee08851124ff4dac388d3c827c30 785468 roundcube-plugins_1.6.19+dfsg-0+deb13u1_all.deb
 7721e3c7521924d19a5194ca4c087ae15fe4ff13b28177a2c9a898404278aab9 101876 roundcube-sqlite3_1.6.19+dfsg-0+deb13u1_all.deb
 6c5a723fbb01c419e974b1016622900c9e2db84f1a50a7f65d1ec38d8e65d5cb 14246 roundcube_1.6.19+dfsg-0+deb13u1_all-buildd.buildinfo
 77feb908575e22c79d396e3048e22f2d7e92991d263b9fddc50c442667b65790 1292 roundcube_1.6.19+dfsg-0+deb13u1_all.deb
Files:
 5c72054d382700b200096197facbf708 4494924 web optional roundcube-core_1.6.19+dfsg-0+deb13u1_all.deb
 5436cd6fd537285dc051d491b6f8ba7e 101924 web optional roundcube-mysql_1.6.19+dfsg-0+deb13u1_all.deb
 7fd53f48dfec7a1302af3808be985c29 101900 web optional roundcube-pgsql_1.6.19+dfsg-0+deb13u1_all.deb
 30c426088ed24ee7d23fe7e94cdee090 785468 web optional roundcube-plugins_1.6.19+dfsg-0+deb13u1_all.deb
 ccb1ca99581b9ae573e10be50e2ecbe9 101876 web optional roundcube-sqlite3_1.6.19+dfsg-0+deb13u1_all.deb
 d2b10725302c37cedd78e3d42dd0232d 14246 web optional roundcube_1.6.19+dfsg-0+deb13u1_all-buildd.buildinfo
 f7ad37fba4d3a237c26d74b985e1bd15 1292 web optional roundcube_1.6.19+dfsg-0+deb13u1_all.deb

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEE81O8NL+3kjBAqEvLmgPNRvTf/zcFAmrD/XUACgkQmgPNRvTf
/zeaZg/9GcdWisS3KTwLcr0sCDsgYYHwn5Oe/O9dn0ufUVP8oVKJdhzj/feMDvK+
42gx7uVEQsC3XYDHra3dhlF+lChV42teasesANmT8ETH5uNugVO8VXjaQC9z2Dyf
baLpAvEMF9lngNq7YykDww16IyJga1gIn0N5oRKkEnLp9A0KLimJGMGoXUe++mZG
w71e4Dw2N9kxLXWbO9Zz4TQLfKZaEtznY1jS9T/U6YduxdJb44+CggR7ea13Mtt8
2PMmVpyDP7i3JGbA5c7jQ9DTxjxi32f7emS2CNOPjxFYqx6xa6UC5Of9xCIOBcXf
vi8DCLlULvoq0NTdBTCRIfS4m8Jk7COnxmoTpFYrNzg6uWke+rdhNB6HaXXn+GeD
iFDMcIf+09JDMvNBiXBTATaubEd/S+US6MoQ1w16LdEk3UAHEQPOt23nyHEJ6/Nj
lqNBfAongdNlBQrju4luFGLNjxQ8jAqwC2JA49hrrCXAY25nAyH7rh/yw/iIXd7k
81PEQfjy+asulAoknTDOsRhKx3Rnn3dB4blMsnkhpnAu7ezHFhUBlFdvh0H/UsXa
SkgiYCiRKp3e6y8Bs5+odjbY9VJWETZnTKGR+ym7CCaaGKhHs5LHI9nsIWxPEtcv
fXHa8M2FURIsRvM02Si2m/eSQ4ybFEiPfpW3+RHuUaRmi+/5Wgo=
=dud4
-----END PGP SIGNATURE-----