Your message dated Mon, 19 Oct 2026 16:19:25 +0000
with message-id <[email protected]>
and subject line Bug#1151279: fixed in roundcube 1.6.20+dfsg-1
has caused the Debian Bug report #1151279,
regarding roundcube: Multiple security vulnerabilities
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1151279: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1151279
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: roundcube
Version: 1.6.19+dfsg-1
Control: found -1 1.6.19+dfsg-0+deb13u1
Control: found -1 1.6.5+dfsg-1+deb12u12
Severity: important
Tags: security upstream
X-Debbugs-Cc: Debian Security Team <[email protected]>
Roundcube webmail upstream has just released 1.6.20 [0] which fixes a
new batch of security vulnerabilities:
* Fix IMAP command injection via CRLF in _uid parameter of mail/headers and
mail/viewsource
action
https://github.com/roundcube/roundcubemail/commit/f62879defc0330ae240c72b83b2d00a8ab337447
* Fix bug where an alias login wasn’t qualified by IMAP host
https://github.com/roundcube/roundcubemail/commit/cb235cbfef88cbf78236dc67d3b667bf3dc61ddd
* Add a size limit to the CSS proxy content processing
https://github.com/roundcube/roundcubemail/commit/99a5bdd05b01f45493cc0da4c96968eac7668126
* Fix SSRF filter (is_local_url()) bypass via NAT64 64:ff9b::/96
https://github.com/roundcube/roundcubemail/commit/3c3a65f66b53b7aaf3d720acd06e0b102eceb090
* Fix remote content blocking bypass via SVG SMIL by attribute
https://github.com/roundcube/roundcubemail/commit/2b6ff79d8b14f94b0ff04765b7f02dbfdfe98efa
* Fix remote content blocking bypass via CSS escapes in FuncIRI attributes
(again)
https://github.com/roundcube/roundcubemail/commit/ff4fcfdd2952f9d09947cc9c18137f381f27caf1
* Fix passing potentally unsafe attachment content into ImageMagick on image
resize
https://github.com/roundcube/roundcubemail/commit/895d88af37720d2b46e4553f524013b2e1cb7665
* Fix mail header injection via the From display-name in the Bounce (resend)
action
https://github.com/roundcube/roundcubemail/commit/3a136465c965776a5f636587187626985dae4f3b
* Fix mail header injection via References/In-Reply-To/Message-ID/From
parameters
https://github.com/roundcube/roundcubemail/commit/79adcfc0c48012bbbe930278471425027fd7331c
* Fix object injection primitive in rcube_session::unserialize() via
“!”-prefixed session
keys
https://github.com/roundcube/roundcubemail/commit/833770d3d3c35cfde74cc2614d368f25a75b6f99
* Fix ImageMagick resource limits bypass by GD fallback during thumbnail
generation
https://github.com/roundcube/roundcubemail/commit/0bea81121efd96f07432a837f391dbdd0dffa33f
* Fix CSS scoping bypass in HTML messages using at-rules
https://github.com/roundcube/roundcubemail/commit/ff9cf4a9bf3b7c66db9afe43fe5f1cc73b47ed35
* Fix bug where deprecated action aliases bypassed disabled_actions setting
https://github.com/roundcube/roundcubemail/commit/e7c512ae09ebd0ae5d0d2f29e00a767bf91f6bbe
* Fix IMAP command injection via CRLF in _flag parameter of mail/mark action
https://github.com/roundcube/roundcubemail/commit/242c6d6a150c850bd96d20d400261e71f8d11f9b
* Fix CSRF validation bypass in the mark-as-junk action
https://github.com/roundcube/roundcubemail/commit/15b0dc0d6e5712310c8f663577361bf8132a7f81
* Fix XSS issue in handling of password driver error responses
https://github.com/roundcube/roundcubemail/commit/94298856ee67ff7817cc4def2adb634be91e28c7
* Fix mail header injection via subject of a message forwarded as attachment
https://github.com/roundcube/roundcubemail/commit/c325953a251d0132f1909569b3eac0b974095dd4
* Fix mail header injection via media type in an inline image data URI
https://github.com/roundcube/roundcubemail/commit/adb9b9b3fd43e30af1c166b79494726d89f828eb
* Fix bug where Password Modoboa driver could change password for another
account
https://github.com/roundcube/roundcubemail/commit/3d9d05bfe2da7f93b8d47e68cadab22bb67e6cc9
* Fix unsafe use of a login name in SquirrelMail import file path
https://github.com/roundcube/roundcubemail/commit/15fd175d154311ca7f59cf696c6cc39471611aa6
AFAIK no CVE-ID have been published for these issues. I'm quite busy this week
and will
probably not find time to file MITRE's form before the week-end.
--
Guilhem.
[0] https://roundcube.net/news/2026/10/19/security-updates-1.6.20-and-1.7.5
https://github.com/roundcube/roundcubemail/releases/tag/1.6.20
signature.asc
Description: PGP signature
--- End Message ---
--- Begin Message ---
Source: roundcube
Source-Version: 1.6.20+dfsg-1
Done: Guilhem Moulin <[email protected]>
We believe that the bug you reported is fixed in the latest version of
roundcube, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Guilhem Moulin <[email protected]> (supplier of updated roundcube package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Mon, 19 Oct 2026 16:51:01 +0200
Source: roundcube
Architecture: source
Version: 1.6.20+dfsg-1
Distribution: unstable
Urgency: medium
Maintainer: Debian Roundcube Maintainers
<[email protected]>
Changed-By: Guilhem Moulin <[email protected]>
Closes: 1151279
Changes:
roundcube (1.6.20+dfsg-1) unstable; urgency=medium
.
* New upstream security and bugfix release (closes: #1151279).
+ Fix IMAP command injection via CRLF in `_uid` parameter of mail/headers
and mail/viewsource action.
+ Fix bug where an alias login wasn't qualified by IMAP host.
+ Add a size limit to the CSS proxy content processing.
+ Fix SSRF filter (is_local_url()) bypass via NAT64 64:ff9b::/96.
+ Fix remote content blocking bypass via SVG SMIL `by` attribute.
+ Fix remote content blocking bypass via CSS escapes in FuncIRI attributes
(again).
+ Fix passing potentially unsafe attachment content into ImageMagick on
image resize.
+ Fix mail header injection via the From display-name in the Bounce
(resend)
action.
+ Fix mail header injection via References/In-Reply-To/Message-ID/From
parameters.
+ Fix object injection primitive in rcube_session::unserialize() via
“!”-prefixed session keys.
+ Fix ImageMagick resource limits bypass by GD fallback during thumbnail
generation.
+ Fix CSS scoping bypass in HTML messages using at-rules.
+ Fix bug where deprecated action aliases bypassed `disabled_actions`
setting.
+ Fix IMAP command injection via CRLF in `_flag` parameter of mail/mark
action.
+ Fix CSRF validation bypass in the mark-as-junk action.
+ Fix XSS issue in handling of password driver error responses.
+ Fix mail header injection via subject of a message forwarded as
attachment.
+ Fix mail header injection via media type in an inline image data URI.
+ Fix bug where Password Modoboa driver could change password for another
account.
+ Fix unsafe use of a login name in SquirrelMail import file path.
* Remove `Depends: ${misc:Depends}` from the binary packages.
* Refresh d/roundcube-core.lintian-overrides.
Checksums-Sha1:
15788fa9018782f7800dd4e7c280a22f82d2f4cf 3845 roundcube_1.6.20+dfsg-1.dsc
32a740c50ee6ae83c79d675e539d9bb4ff86ca19 126856
roundcube_1.6.20+dfsg.orig-tinymce-langs.tar.xz
c17351cead238baa4a63bce2b136ff054c2034f9 1928744
roundcube_1.6.20+dfsg.orig-tinymce.tar.xz
d6cb3e64e6cef16458b627130240c0e7e88b7536 2921204
roundcube_1.6.20+dfsg.orig.tar.xz
12748f310f554dda71c7ff9eb85ee3c8fd57c223 160736
roundcube_1.6.20+dfsg-1.debian.tar.xz
d5074c57b5ce2b37285b8d638a43fac0b0679d71 6606
roundcube_1.6.20+dfsg-1_source.buildinfo
Checksums-Sha256:
ad49d6e2c5b2456fd1181965d6e2d95b791550fb1fd49f5a8594c5b7db0f0286 3845
roundcube_1.6.20+dfsg-1.dsc
b7968a5dd8a32fdbde4afd733111a6fd44cbfa346332bd07e4dcf2c5b09007cf 126856
roundcube_1.6.20+dfsg.orig-tinymce-langs.tar.xz
5f0d2f90355cd16d94d6be3e857995be0c4bad6b96cde894815901577eba5c34 1928744
roundcube_1.6.20+dfsg.orig-tinymce.tar.xz
fa1b308c9e3169776321b80af6f1831329b1947a515a024fe9032e31055c3b39 2921204
roundcube_1.6.20+dfsg.orig.tar.xz
67eb7e731cd90162e0c4e094c6479ffc58c78b3482452c50e7ed194a5e957b7f 160736
roundcube_1.6.20+dfsg-1.debian.tar.xz
9983c4c0dceb08ac00793e7647c0260c2d85681693ad48f776404b6bde523e44 6606
roundcube_1.6.20+dfsg-1_source.buildinfo
Files:
2b50841dc93f7b8d5f4e129b8816c61c 3845 web optional roundcube_1.6.20+dfsg-1.dsc
9f448ec4c449b2c7a9af1544112ef559 126856 web optional
roundcube_1.6.20+dfsg.orig-tinymce-langs.tar.xz
c7276aef6d00b70deda0abf66bc2e050 1928744 web optional
roundcube_1.6.20+dfsg.orig-tinymce.tar.xz
a7ab89080eb8e14bc5433bbd30b05120 2921204 web optional
roundcube_1.6.20+dfsg.orig.tar.xz
4b02718efe18e2ffffbe2193f630da79 160736 web optional
roundcube_1.6.20+dfsg-1.debian.tar.xz
c94235c8487a69860e3762d710f6a96e 6606 web optional
roundcube_1.6.20+dfsg-1_source.buildinfo
-----BEGIN PGP SIGNATURE-----
iQIyBAEBCgAdFiEERpy6p3b9sfzUdbME05pJnDwhpVIFAmrWPoEACgkQ05pJnDwh
pVI7Ug/4zojdCk8ECAJ0ebvX7Rq6bCzGvUF/05TZnw+VlFnTrDnB1lUrR4eK8SPG
Fn+6Vg8DzyqFdl5wsb4QGCdjGhzKdOOGW9QifKa2lbkN6fGbYIM4Q8CEDMr3jn1g
aUbYzl94LA1MBdpr+SZrq1U8TpnR2r9NHvP7OckqRR8gN7SjdS37PiH36+8DsC5I
58YQm4jgH1NekIBRlFbysicyuHJMqe3KbEI1rZQ+s2QS0fDFyokfond9PGj1CP9e
J7pH5/0yU2OJS0Yw1GErqbt7Z1rW4hNXCujmSORT2UYQ2sAuKX3SdKbvvUQMPZZN
l68u9T06OjDxEZQVVRucRQkUDROp4t98vA6r+uVnHlfOV4L0NwpKyIYdhc5i64j4
Ph8Z7ViDgn022QbZNfaX9sWEUO7du/lPU03eFBjYKXU74UdDEvlZp5HE280W/uJd
lUaWveT1dpMRo4SiLRDbelVSfvbzeguc2el7UKMpIj7H/vk2txyMY5AKz/FboQEE
E5YxkUJ+ncuc4qPzQsgenYbbcpUjXG3O+a3/PbRJn99gKrxIiGY9T4r+KRdxBbAd
L7zvBcaEDIzWlwPlwlYbtHreMizCd2glmivDQPtAIOXblUoq3m1frpS0Gm+Tubwm
bgTalwF5Zfh9ktQxGpc/5WTxcd4wITSGkpwxHkZq0oPmgvo8/A==
=eGBZ
-----END PGP SIGNATURE-----
pgp8fP0AF7b9g.pgp
Description: PGP signature
--- End Message ---
