Your message dated Sun, 05 Jul 2026 16:04:19 +0000
with message-id <[email protected]>
and subject line Bug#1138086: fixed in roundcube 1.6.17+dfsg-1
has caused the Debian Bug report #1138086,
regarding DSA 6301-1 breaks roundcube on PHP <8
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1138086: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1138086
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Package: roundcube
Version: 1.6.5+dfsg-1+deb12u9
Severity: important
Dear Maintainer,
*** Reporter, please consider answering these questions, where appropriate ***
* What led up to the situation?
Installing security update DSA 6301-1 on debian 12
* What exactly did you do (or not do) that was effective (or
ineffective)?
apt-get update; apt-get upgrade. Error during upgrade:
PHP Parse error: syntax error, unexpected '|', expecting ';' or '{' in
/usr/share/roundcube/program/lib/Roundcube/rcube_utils.php on line 431
Fatal error: Please check the Roundcube error log and/or server error logs
for more information.
* What was the outcome of this action?
Webmail does not work :
Oops... something went wrong!
An internal error has occurred. Your request cannot be processed at this
time.
For administrators: Please check the application and/or server error logs
for more information.
apache error log is full of [Thu May 28 10:06:47.523141 2026] [php7:error] [pid
26433:tid 26433] [client 10.3.20.97:62510] PHP Parse error: syntax error,
unexpected '|', expecting ';' or '{' in
/usr/share/roundcube/program/lib/Roundcube/rcube_utils.php on line 431
Running php 7.4
* What outcome did you expect instead?
*** End of the template - remove these template lines ***
-- System Information:
Debian Release: 12.14
APT prefers oldstable-updates
APT policy: (500, 'oldstable-updates'), (500, 'oldstable-security'), (500,
'oldstable')
Architecture: amd64 (x86_64)
Kernel: Linux 6.1.0-48-amd64 (SMP w/4 CPU threads; PREEMPT)
Locale: LANG=cs_CZ.UTF-8, LC_CTYPE=cs_CZ.UTF-8 (charmap=UTF-8) (ignored: LC_ALL
set to C.UTF-8), LANGUAGE=en_US:en
Shell: /bin/sh linked to /usr/bin/dash
Init: sysvinit (via /sbin/init)
LSM: AppArmor: enabled
Versions of packages roundcube depends on:
ii dpkg 1.21.23
ih roundcube-core 1.6.5+dfsg-1+deb12u9
roundcube recommends no packages.
roundcube suggests no packages.
Versions of packages roundcube-core depends on:
ii dbconfig-common 2.0.24
ii debconf [debcon 1.5.82
f-2.0]
ii dpkg 1.21.23
ii libapache2-mod- 8.2.31-1~deb12u1
php8.2 [php-jso
n]
ii libjs-bootstrap 4.6.1+dfsg1-4+deb12u1
4
ii libjs-codemirro 5.65.0+~cs5.83.9-2
r
ii libjs-jquery 3.6.1+dfsg+~3.5.14-1
ii libjs-jquery-mi 2.3.5+dfsg-4
nicolors
ii libjs-jquery-ui 1.13.2+dfsg-1
ii libjs-jstimezon 1.0.7+~1.0.3-1
edetect
ii libmagic1 1:5.44-3
ii php 2:8.2+93
ii php-auth-sasl 1.1.0-1
ii php-common 2:94+0~20240205.51+debian10~1.gbp6faa2e
ii php-guzzlehttp- 7.4.5-1
guzzle
ii php-intl 2:8.2+93
ii php-json 2:8.2+93
ii php-mail-mime 1.10.11-1
ii php-masterminds 2.7.6+dfsg-1
-html5
ii php-mbstring 2:8.2+93
ii php-net-sieve 1.4.6-1
ii php-net-smtp 1.10.1-1
ii php-pear 1:1.10.13+submodules+notgz+2022032202-2+0~20230612.39+debi
an10~1.gbpfd4c1d
ii php5.6 [php] 5.6.40-86+0~20250817.110+debian12~1.gbp00d7b7
ii php5.6-cli [php 5.6.40-86+0~20250817.110+debian12~1.gbp00d7b7
-cli]
ii php5.6-json [ph 5.6.40-86+0~20250817.110+debian12~1.gbp00d7b7
p-json]
ii php7.4 [php] 7.4.33-1+deb11u9
ii php7.4-cli [php 7.4.33-1+deb11u9
-cli]
ii php7.4-intl [ph 7.4.33-1+deb11u9
p-intl]
ii php7.4-json [ph 7.4.33-1+deb11u9
p-json]
ii php7.4-mbstring 7.4.33-1+deb11u9
[php-mbstring]
ii php8.2 [php] 8.2.31-1~deb12u1
ii php8.2-cli [php 8.2.31-1~deb12u1
-json]
ii php8.2-intl [ph 8.2.31-1~deb12u1
p-intl]
ii php8.2-mbstring 8.2.31-1~deb12u1
[php-mbstring]
ii php8.2-phpdbg [ 8.2.31-1~deb12u1
php-json]
ii roundcube-mysql 1.6.5+dfsg-1+deb12u9
ii ucf 3.0043+nmu1+deb12u1
Versions of packages roundcube-core recommends:
ii apache2 [httpd-cgi] 2.4.67-1~deb12u2
ii php-enchant 2:8.2+93
ii php-gd 2:8.2+93
ii php7.4-gd [php-gd] 7.4.33-1+deb11u9
ii php8.2-enchant [php-enchant] 8.2.31-1~deb12u1
ii php8.2-gd [php-gd] 8.2.31-1~deb12u1
ii roundcube-skin-classic 1.6.0+ds-2
ii roundcube-skin-larry 1.6.0+ds-2
Versions of packages roundcube-core suggests:
pn php-bacon-qr-code <none>
pn php-bjeavons-zxcvbn-php <none>
ii php-crypt-gpg 1.6.7-2
ii php-net-ldap3 1.1.4-1
pn php-roundcube-rtf-html-php <none>
iu roundcube-plugins 1.6.5+dfsg-1+deb12u9
-- debconf information:
* roundcube/language: cs_CZ
roundcube/missing-db-package-error: abort
* roundcube/mysql/method: Unix socket
roundcube/dbconfig-remove: true
roundcube/remove-error: abort
* roundcube/reconfigure-webserver: apache2
roundcube/internal/reconfiguring: false
* roundcube/db/app-user: roundcube@localhost
roundcube/upgrade-error: abort
* roundcube/db/dbname: roundcube3
* roundcube/restart-webserver: true
* roundcube/mysql/authplugin: default
roundcube/internal/skip-preseed: false
roundcube/purge: false
* roundcube/mysql/admin-user: debian-sys-maint
* roundcube/database-type: mysql
roundcube/remote/host: localhost
roundcube/passwords-do-not-match:
roundcube/upgrade-backup: true
* roundcube/dbconfig-reinstall: false
roundcube/remote/newhost:
roundcube/install-error: abort
roundcube/remote/port:
* roundcube/dbconfig-install: true
* roundcube/hosts: localhost:143
roundcube/dbconfig-upgrade: true
--- End Message ---
--- Begin Message ---
Source: roundcube
Source-Version: 1.6.17+dfsg-1
Done: Guilhem Moulin <[email protected]>
We believe that the bug you reported is fixed in the latest version of
roundcube, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Guilhem Moulin <[email protected]> (supplier of updated roundcube package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Sun, 05 Jul 2026 17:26:53 +0200
Source: roundcube
Architecture: source
Version: 1.6.17+dfsg-1
Distribution: unstable
Urgency: high
Maintainer: Debian Roundcube Maintainers
<[email protected]>
Changed-By: Guilhem Moulin <[email protected]>
Closes: 1138086 1141495
Changes:
roundcube (1.6.17+dfsg-1) unstable; urgency=high
.
* New upstream security and bugfix release (closes: #1141495).
+ Fix infinite loop in TNEF (winmail.dat) decoder.
+ Fix various vulnerabilities in the password plugin using
session-injected username.
+ Fix CVE-2026-54432: Stored XSS via unescaped attachment MIME type on the
attachment-validation warning page.
+ Fix SSRF bypass via specific local address URLs.
+ Fix CVE-2026-54433: Zero-click stored XSS in plain-text rendering.
+ Fix DoS via crafted compressed-RTF size in the TNEF (winmail.dat) file.
+ Enigma: Add support for automatic public key lookup (import) using HKP
v1 protocol.
+ Enigma: Add support for Kolab's Web Of Anti-Trust (WOAT) feature.
* d/p/Avoid-dependency-on-new-package-mlocati-ip-lib.patch: Improve patch
and drop type annotations to restore compatibility with PHP<8 (closes:
#1138086).
Checksums-Sha1:
cc90069cc1df4a571acd39ce7d8b196b3729a2b2 3845 roundcube_1.6.17+dfsg-1.dsc
c42a03f7b7f449f7ec9023843d775b66e2887e31 126836
roundcube_1.6.17+dfsg.orig-tinymce-langs.tar.xz
a14b229b6767817fb36d85c6c22b700e81fcc74a 1928888
roundcube_1.6.17+dfsg.orig-tinymce.tar.xz
1f753251c7e378540cea602af4a7f5db415764fa 2906816
roundcube_1.6.17+dfsg.orig.tar.xz
3e31aaa811424ffebdd43e601f014e46a56d6b6c 159116
roundcube_1.6.17+dfsg-1.debian.tar.xz
cc5c4a419d387e71bd5a5047ed7b18e3f518ce0d 6227
roundcube_1.6.17+dfsg-1_source.buildinfo
Checksums-Sha256:
5ddbaa4318bc081ac0b28d46522d702fb3a89220ca26038c7e20e4588ee4a65b 3845
roundcube_1.6.17+dfsg-1.dsc
a9e0dcf588cdfd398b1ffacb63d3cc6cf2132785adcf98b9bc3cb7b23f9f1f6e 126836
roundcube_1.6.17+dfsg.orig-tinymce-langs.tar.xz
870c74fc7fe5f66929a8f45b7340be3d542d94ef5786d92393bfbf687c57b1fa 1928888
roundcube_1.6.17+dfsg.orig-tinymce.tar.xz
c32cae39892d8936f1b07712e0cda3f435d311cd095e6d949d8e62c473ae1426 2906816
roundcube_1.6.17+dfsg.orig.tar.xz
d4a4cfd1cc4c48007af7e059cb201ba800b92ec1185f7f3d2f0c5429e25e9367 159116
roundcube_1.6.17+dfsg-1.debian.tar.xz
87e264d6e5a915851d22b91aeaab2652671903f08c8f57690fb931aaa0edceef 6227
roundcube_1.6.17+dfsg-1_source.buildinfo
Files:
b9a10be22b02a0bf26798952f2d58b30 3845 web optional roundcube_1.6.17+dfsg-1.dsc
14e66bb6839218d4add3e1fbea68952d 126836 web optional
roundcube_1.6.17+dfsg.orig-tinymce-langs.tar.xz
d1198f417f0ae874dedee8a12e7c8713 1928888 web optional
roundcube_1.6.17+dfsg.orig-tinymce.tar.xz
dc32d01c80607b6c6ab3a206e354e584 2906816 web optional
roundcube_1.6.17+dfsg.orig.tar.xz
66ef61fd6e2c2ba68d5731a617f3c9d1 159116 web optional
roundcube_1.6.17+dfsg-1.debian.tar.xz
fa5e7976140601b140b3b19a0214fb9d 6227 web optional
roundcube_1.6.17+dfsg-1_source.buildinfo
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEERpy6p3b9sfzUdbME05pJnDwhpVIFAmpKebwACgkQ05pJnDwh
pVKMjQ/9FASx8Pq8QeLmityAdMYXFizs6anN2uBThC1gIvWtRrL6bogVQTbUILWM
ISZKtGsxgSn6MA4vKU2ILbJdidb1mN+Hc+7TdOaWqxQEcX+tsFzuV4oJbAhyurzM
rm+uPytsTEekBfTBjYTbNaLsj4WE+0qHTLnGjUgHGk3DK9w48tvIBoJnxWYIuq1D
/7n2OP8sPEsXlmuey47wBF7xhvgj2krBOpDOPjAoROuNK0foc3zcFmSvDDx/2Ldv
ooE0DUkq/iQPcJw/1a+UrxqyIYNoD40qq7avTF4uF6vRgta2mNOyOBHwMcioPqlq
RvUYLlMp18vy9TtkK9HFcnN9PEAuiNpGPbS5tNhxXXfT9uZpZTgHqBgIPd0UfAM4
Oe61c06IRA9XYHayR8zpabguRsNn2GdJxJO74HXzI9Q5gxy1WW8lAL9KR9IuUsEV
eZNHvUtELqth2O/c1xWuLurYxZAiFjCtzK7Xg4mLT18CEXduR24WrQU5mFZN4ApQ
c+tQNdSY3XiQ+JcQY9klPdjb0PborZH2PShLUOAYUTR9R2XZlMvuzRIogaxnel2v
YPO8HA6QrVZNCmvfVTkkwJBRiywXfCqKPSmjHJiEaSTQVdqJ8F1o2vLI+3h0ECyw
h/wLup2HG2YhezdBw9g8xwZCtL4OAP2In3HCNd6cnJaLdLjSFGo=
=dyWy
-----END PGP SIGNATURE-----
pgpRP0Yjd34uM.pgp
Description: PGP signature
--- End Message ---
