Your message dated Sun, 11 Oct 2026 11:52:28 +0000
with message-id <[email protected]>
and subject line Bug#1146838: fixed in roundcube 1.6.19+dfsg-0+deb13u1
has caused the Debian Bug report #1146838,
regarding roundcube: Multiple security vulnerabilities
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1146838: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1146838
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: roundcube
Version: 1.6.18+dfsg-1
Control: found -1 1.6.18+dfsg-0+deb13u1
Control: found -1 1.6.5+dfsg-1+deb12u11
Severity: important
Tags: security upstream
X-Debbugs-Cc: Debian Security Team <[email protected]>
Roundcube webmail upstream has just released 1.6.19 [0] which fixes
a new batch of security vulnerabilities:
1. CSS declaration smuggling via un-encoded ampersand emission
https://github.com/roundcube/roundcubemail/commit/8119eb061bffd6d967ee34e7bda21e20237fc1e0
2. CSS property injection via body `background` attribute
https://github.com/roundcube/roundcubemail/commit/030de9a4e58699a336f62868017ea5271128c52f
Follow-up:
https://github.com/roundcube/roundcubemail/commit/3092bd9fbe65b243cf419352ddd3e53e5086c6cc
Follow-up:
https://github.com/roundcube/roundcubemail/commit/2869de81c94dee300df4193276cce588f10350e1
Follow-up:
https://github.com/roundcube/roundcubemail/commit/29beae7282135a3cd59a3945bd33ee8f904d6217
3. Email header injection via bare CR in the subject field
https://github.com/roundcube/roundcubemail/commit/73d864e06cb26000a37ad57ae439842a85b6690e
4. Email header injection via C-escape \r in the recipient display name
https://github.com/roundcube/roundcubemail/commit/d1238ef1fb0d66a9bacf6b01926b911f70515071
5. Email header injection via identity’s organization field
https://github.com/roundcube/roundcubemail/commit/11e5c9be0369e3b76bfee2ae095f57532bae0f1f
6. Zero-click stored XSS via TNEF MIME tag injection in the attachment URL
https://github.com/roundcube/roundcubemail/commit/e4a0f82f4c648606de0867ee16b4a5f591ddbd69
Follow-up:
https://github.com/roundcube/roundcubemail/commit/7095e8d9de10d2f8bb90c3639c582edf8e371d5c
7. XSS in the HTML editor using text/enriched part content
https://github.com/roundcube/roundcubemail/commit/1381bf5d7e4c595560acf0228a2e68e471cefbd8
8. Cross-user access in contact group membership (add/remove) in the SQL
address book
https://github.com/roundcube/roundcubemail/commit/19ba077a859b590bd886b437a6c8a3fdd8aa3952
9. `is_local_url()` bypass via trailing-dot FQDN in stylesheet URL
https://github.com/roundcube/roundcubemail/commit/9c4099bbff33062c8ab6e09d9b71e59dde295408
10. Remote content blocking bypass via CSS escapes in FuncIRI attributes
https://github.com/roundcube/roundcubemail/commit/9aa2b3f13c3707ac24aee9899dd4ab693ee1e471
11. Remote-content blocker bypass via SVG SMIL src animation
https://github.com/roundcube/roundcubemail/commit/2bed9eeb5707636b8e5b915ae18d4d06b3971f31
12. SSRF bypass in Roundcube CSS proxy via hexadecimal IPv6-mapped IPv4
addresses
https://github.com/roundcube/roundcubemail/commit/05cc67c6bc501e2d818436dec571f9712f16ea61
AFAIK no CVE-ID have been published for these issues. I'm currently
traveling but will request some next week unless someone beats me to it.
--
Guilhem.
[0] https://roundcube.net/news/2026/09/06/security-updates-1.6.19-and-1.7.4
https://github.com/roundcube/roundcubemail/releases/tag/1.6.19
signature.asc
Description: PGP signature
--- End Message ---
--- Begin Message ---
Source: roundcube
Source-Version: 1.6.19+dfsg-0+deb13u1
Done: Guilhem Moulin <[email protected]>
We believe that the bug you reported is fixed in the latest version of
roundcube, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Guilhem Moulin <[email protected]> (supplier of updated roundcube package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Sun, 06 Sep 2026 13:22:41 +0200
Source: roundcube
Architecture: source
Version: 1.6.19+dfsg-0+deb13u1
Distribution: trixie-security
Urgency: high
Maintainer: Debian Roundcube Maintainers
<[email protected]>
Changed-By: Guilhem Moulin <[email protected]>
Closes: 1146838
Changes:
roundcube (1.6.19+dfsg-0+deb13u1) trixie-security; urgency=high
.
* New upstream security and bugfix release (closes: #1146838).
+ Fix CSS declaration smuggling via un-encoded ampersand emission.
+ Fix CSS property injection via body `background` attribute.
+ Fix email header injection via bare CR in the subject field.
+ Fix email header injection via C-escape `\r` in the recipient display
name.
+ Fix email header injection via identity's organization field.
+ Fix zero-click stored XSS via TNEF MIME tag injection in the attachment
URL.
+ Fix XSS in the HTML editor using text/enriched part content.
+ Fix cross-user access in contact group membership (add/remove) in the
SQL address book.
+ Fix `is_local_url()` bypass via trailing-dot FQDN in stylesheet URL.
+ Fix remote content blocking bypass via CSS escapes in FuncIRI
attributes.
+ Fix remote-content blocker bypass via SVG SMIL src animation.
* Refresh d/patches and remove those applied upstream.
Checksums-Sha1:
abf62dd6b4459360ffeebfdb534b34f991e26857 3860
roundcube_1.6.19+dfsg-0+deb13u1.dsc
42a4a432e26557e1f256016fd70522a3e5fc7dd8 126884
roundcube_1.6.19+dfsg.orig-tinymce-langs.tar.xz
f181c2ba04cea59621711962e3553c53e9d9882a 1928432
roundcube_1.6.19+dfsg.orig-tinymce.tar.xz
8c7c229d2ba194dc8dfb1874efb9b1401a786ff1 2910024
roundcube_1.6.19+dfsg.orig.tar.xz
51af771a0b18501a16527b46ca2e1fc06816fc89 158696
roundcube_1.6.19+dfsg-0+deb13u1.debian.tar.xz
e1a03051a51563b0d244aa009a19c4f4168ad7df 6633
roundcube_1.6.19+dfsg-0+deb13u1_source.buildinfo
Checksums-Sha256:
9e4fc3d1153b54397d74fd0ea4edbe6c3b18ea6f947885ecc004bf85ab5b7e13 3860
roundcube_1.6.19+dfsg-0+deb13u1.dsc
83b2d0ee3e4d937f86d1a8db01deed4c18c1d097a964a3134f9c0748c6eb0dfb 126884
roundcube_1.6.19+dfsg.orig-tinymce-langs.tar.xz
d6a37e1987aa5c3b027f916f18ebbb778c38ee3e0cdf236ee88725ab07cdd6f9 1928432
roundcube_1.6.19+dfsg.orig-tinymce.tar.xz
10e6ffaeae68f5aa3d7c41fe5e5c29ca37df500ced8a2b75a0fae66f190050f1 2910024
roundcube_1.6.19+dfsg.orig.tar.xz
a3de3cdfe507885459cfce4932b5b6ff1a213af54119d50ae7bc3219db64d6e5 158696
roundcube_1.6.19+dfsg-0+deb13u1.debian.tar.xz
46c42ca65a13c105099d70972a23a7fdc6b282541e2dff82d64c33d6cd6d0d8b 6633
roundcube_1.6.19+dfsg-0+deb13u1_source.buildinfo
Files:
26adba7d4bf72a3d6ebcb8b118cad0b3 3860 web optional
roundcube_1.6.19+dfsg-0+deb13u1.dsc
8ac2d1ce8d0f3d2979ad98f17a3a5090 126884 web optional
roundcube_1.6.19+dfsg.orig-tinymce-langs.tar.xz
92283952d3baebc2b092c1298a7f4c0e 1928432 web optional
roundcube_1.6.19+dfsg.orig-tinymce.tar.xz
5d27f90436ad392e742590cc0918a18f 2910024 web optional
roundcube_1.6.19+dfsg.orig.tar.xz
20e2aac5f25eec65333982ce073acb66 158696 web optional
roundcube_1.6.19+dfsg-0+deb13u1.debian.tar.xz
dc22a9f63813ddaafe25d59fc20f8178 6633 web optional
roundcube_1.6.19+dfsg-0+deb13u1_source.buildinfo
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEERpy6p3b9sfzUdbME05pJnDwhpVIFAmrD94wACgkQ05pJnDwh
pVLa9g//VZBBNRaQINXz9/8PFXfjlENS72pmSiAnTotXsHsX/r6gQDV6HuOu+rUE
hgHT2V5ZJXe/CaQfLHodSBIjqf2SdDi/7xADyrsnqSc+Qq4V9on25YSj9J6pyRSA
PIixw7TE8a+K+SD9RNGTryXdBVOHBdxDLUA5bh1a2R2RcwswxRT4ozpAyKLm7T1Q
uhiP7X8gEHafJ9n58yzXS5iI1UrieZb1uhMP7oTpKhgufVgkOnv5o6ppGPMJejtW
gzoECHGrZoadtkGCM7+RzzjJccntQgoJ+XVeKeCMc5y41Vxm+7RnDzJy0IYpepp5
whUjUbYcHbNMj7s8t3+BNfMqc6Ukuf0H7IV0iWuJ0aYcWgsKIYKMKQ33u8xInGBw
hS1f2G0I2PLslIv00AVZsR0ba4goEH/FsydCxboFU4IfI1PsdhFrBdH/g16OBLx5
5+gMxGxjyyzN1I3BTHvZ4VXrbvlmd/60nflIt/EOPA1nte177guhKtcnHrVkV+6X
J2Yf9xH+gzqtfy3wIFlS6IeFTmZBdzgpFQ/8V1mVoOU/wks7XAV1bc6jAFXY5a2s
Th9uNYVb+I+me9fEoEDIKoqo3SQYM5h4RmBwzP96LQ5AlFzXVhX0Tyuur2ZbKis9
tJ5H4vz8+b6HlAMvsP8NsDuIhqRrxx0D3yOr1tbTibH1Bug4GdE=
=K6yv
-----END PGP SIGNATURE-----
pgpJIyjwCO4HJ.pgp
Description: PGP signature
--- End Message ---
