Your message dated Thu, 29 Oct 2026 13:30:02 +0000
with message-id <[email protected]>
and subject line Bug#1151279: fixed in roundcube 1.6.20+dfsg-0+deb13u1
has caused the Debian Bug report #1151279,
regarding roundcube: Multiple security vulnerabilities
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1151279: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1151279
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: roundcube
Version: 1.6.19+dfsg-1
Control: found -1 1.6.19+dfsg-0+deb13u1
Control: found -1 1.6.5+dfsg-1+deb12u12
Severity: important
Tags: security upstream
X-Debbugs-Cc: Debian Security Team <[email protected]>
Roundcube webmail upstream has just released 1.6.20 [0] which fixes a
new batch of security vulnerabilities:
* Fix IMAP command injection via CRLF in _uid parameter of mail/headers and
mail/viewsource
action
https://github.com/roundcube/roundcubemail/commit/f62879defc0330ae240c72b83b2d00a8ab337447
* Fix bug where an alias login wasn’t qualified by IMAP host
https://github.com/roundcube/roundcubemail/commit/cb235cbfef88cbf78236dc67d3b667bf3dc61ddd
* Add a size limit to the CSS proxy content processing
https://github.com/roundcube/roundcubemail/commit/99a5bdd05b01f45493cc0da4c96968eac7668126
* Fix SSRF filter (is_local_url()) bypass via NAT64 64:ff9b::/96
https://github.com/roundcube/roundcubemail/commit/3c3a65f66b53b7aaf3d720acd06e0b102eceb090
* Fix remote content blocking bypass via SVG SMIL by attribute
https://github.com/roundcube/roundcubemail/commit/2b6ff79d8b14f94b0ff04765b7f02dbfdfe98efa
* Fix remote content blocking bypass via CSS escapes in FuncIRI attributes
(again)
https://github.com/roundcube/roundcubemail/commit/ff4fcfdd2952f9d09947cc9c18137f381f27caf1
* Fix passing potentally unsafe attachment content into ImageMagick on image
resize
https://github.com/roundcube/roundcubemail/commit/895d88af37720d2b46e4553f524013b2e1cb7665
* Fix mail header injection via the From display-name in the Bounce (resend)
action
https://github.com/roundcube/roundcubemail/commit/3a136465c965776a5f636587187626985dae4f3b
* Fix mail header injection via References/In-Reply-To/Message-ID/From
parameters
https://github.com/roundcube/roundcubemail/commit/79adcfc0c48012bbbe930278471425027fd7331c
* Fix object injection primitive in rcube_session::unserialize() via
“!”-prefixed session
keys
https://github.com/roundcube/roundcubemail/commit/833770d3d3c35cfde74cc2614d368f25a75b6f99
* Fix ImageMagick resource limits bypass by GD fallback during thumbnail
generation
https://github.com/roundcube/roundcubemail/commit/0bea81121efd96f07432a837f391dbdd0dffa33f
* Fix CSS scoping bypass in HTML messages using at-rules
https://github.com/roundcube/roundcubemail/commit/ff9cf4a9bf3b7c66db9afe43fe5f1cc73b47ed35
* Fix bug where deprecated action aliases bypassed disabled_actions setting
https://github.com/roundcube/roundcubemail/commit/e7c512ae09ebd0ae5d0d2f29e00a767bf91f6bbe
* Fix IMAP command injection via CRLF in _flag parameter of mail/mark action
https://github.com/roundcube/roundcubemail/commit/242c6d6a150c850bd96d20d400261e71f8d11f9b
* Fix CSRF validation bypass in the mark-as-junk action
https://github.com/roundcube/roundcubemail/commit/15b0dc0d6e5712310c8f663577361bf8132a7f81
* Fix XSS issue in handling of password driver error responses
https://github.com/roundcube/roundcubemail/commit/94298856ee67ff7817cc4def2adb634be91e28c7
* Fix mail header injection via subject of a message forwarded as attachment
https://github.com/roundcube/roundcubemail/commit/c325953a251d0132f1909569b3eac0b974095dd4
* Fix mail header injection via media type in an inline image data URI
https://github.com/roundcube/roundcubemail/commit/adb9b9b3fd43e30af1c166b79494726d89f828eb
* Fix bug where Password Modoboa driver could change password for another
account
https://github.com/roundcube/roundcubemail/commit/3d9d05bfe2da7f93b8d47e68cadab22bb67e6cc9
* Fix unsafe use of a login name in SquirrelMail import file path
https://github.com/roundcube/roundcubemail/commit/15fd175d154311ca7f59cf696c6cc39471611aa6
AFAIK no CVE-ID have been published for these issues. I'm quite busy this week
and will
probably not find time to file MITRE's form before the week-end.
--
Guilhem.
[0] https://roundcube.net/news/2026/10/19/security-updates-1.6.20-and-1.7.5
https://github.com/roundcube/roundcubemail/releases/tag/1.6.20
signature.asc
Description: PGP signature
--- End Message ---
--- Begin Message ---
Source: roundcube
Source-Version: 1.6.20+dfsg-0+deb13u1
Done: Guilhem Moulin <[email protected]>
We believe that the bug you reported is fixed in the latest version of
roundcube, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Guilhem Moulin <[email protected]> (supplier of updated roundcube package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Tue, 20 Oct 2026 07:00:29 +0200
Source: roundcube
Architecture: source
Version: 1.6.20+dfsg-0+deb13u1
Distribution: trixie-security
Urgency: high
Maintainer: Debian Roundcube Maintainers
<[email protected]>
Changed-By: Guilhem Moulin <[email protected]>
Closes: 1151279
Changes:
roundcube (1.6.20+dfsg-0+deb13u1) trixie-security; urgency=high
.
* New upstream security and bugfix release (closes: #1151279).
+ Fix CVE-2026-113386: IMAP command injection via CRLF in `_uid` parameter
of mail/headers and mail/viewsource action.
+ Fix bug where an alias login wasn't qualified by IMAP host.
+ Add a size limit to the CSS proxy content processing.
+ Fix SSRF filter (`is_local_url()`) bypass via NAT64 64:ff9b::/96.
+ Fix remote content blocking bypass via SVG SMIL `by` attribute.
+ Fix remote content blocking bypass via CSS escapes in FuncIRI attributes
(again).
+ Fix passing potentially unsafe attachment content into ImageMagick on
image resize.
+ Fix mail header injection via the From display-name in the Bounce
(resend)
action.
+ Fix mail header injection via References/In-Reply-To/Message-ID/From
parameters.
+ Fix object injection primitive in rcube_session::unserialize() via
“!”-prefixed session keys.
+ Fix ImageMagick resource limits bypass by GD fallback during thumbnail
generation.
+ Fix CSS scoping bypass in HTML messages using at-rules.
+ Fix bug where deprecated action aliases bypassed `disabled_actions`
setting.
+ Fix IMAP command injection via CRLF in `_flag` parameter of mail/mark
action.
+ Fix CSRF validation bypass in the mark-as-junk action.
+ Fix XSS issue in handling of password driver error responses.
+ Fix mail header injection via subject of a message forwarded as
attachment.
+ Fix mail header injection via media type in an inline image data URI.
+ Fix bug where Password Modoboa driver could change password for another
account.
+ Fix unsafe use of a login name in SquirrelMail import file path.
* Refresh d/patches.
Checksums-Sha1:
a0a03bd91aa0a453fce1b0fe81640b2e3e991ee0 3860
roundcube_1.6.20+dfsg-0+deb13u1.dsc
32a740c50ee6ae83c79d675e539d9bb4ff86ca19 126856
roundcube_1.6.20+dfsg.orig-tinymce-langs.tar.xz
c17351cead238baa4a63bce2b136ff054c2034f9 1928744
roundcube_1.6.20+dfsg.orig-tinymce.tar.xz
d6cb3e64e6cef16458b627130240c0e7e88b7536 2921204
roundcube_1.6.20+dfsg.orig.tar.xz
edd75d5f492f832d17bc7651d442b81b18b7c0e4 159268
roundcube_1.6.20+dfsg-0+deb13u1.debian.tar.xz
3e6098a85573a04218818f1003cc7dcc40fb39ac 6734
roundcube_1.6.20+dfsg-0+deb13u1_source.buildinfo
Checksums-Sha256:
9e5652f65efed5c66c87c929b71c4e423866e49dcee0ed69a9810b669b020fa1 3860
roundcube_1.6.20+dfsg-0+deb13u1.dsc
b7968a5dd8a32fdbde4afd733111a6fd44cbfa346332bd07e4dcf2c5b09007cf 126856
roundcube_1.6.20+dfsg.orig-tinymce-langs.tar.xz
5f0d2f90355cd16d94d6be3e857995be0c4bad6b96cde894815901577eba5c34 1928744
roundcube_1.6.20+dfsg.orig-tinymce.tar.xz
fa1b308c9e3169776321b80af6f1831329b1947a515a024fe9032e31055c3b39 2921204
roundcube_1.6.20+dfsg.orig.tar.xz
ebcd742800aff6baed866d2fd2b71a7b078e92b0ab0d9ea260df3bdef0e6dd18 159268
roundcube_1.6.20+dfsg-0+deb13u1.debian.tar.xz
e753bd947e230d50d76f7d805381f88db5d4ac2dae1e21084d90787cc33dbf3e 6734
roundcube_1.6.20+dfsg-0+deb13u1_source.buildinfo
Files:
133edf32ba197c0740e7581a99b8c77c 3860 web optional
roundcube_1.6.20+dfsg-0+deb13u1.dsc
9f448ec4c449b2c7a9af1544112ef559 126856 web optional
roundcube_1.6.20+dfsg.orig-tinymce-langs.tar.xz
c7276aef6d00b70deda0abf66bc2e050 1928744 web optional
roundcube_1.6.20+dfsg.orig-tinymce.tar.xz
a7ab89080eb8e14bc5433bbd30b05120 2921204 web optional
roundcube_1.6.20+dfsg.orig.tar.xz
6f9acb638292ccedde2dfbf78a7caa2c 159268 web optional
roundcube_1.6.20+dfsg-0+deb13u1.debian.tar.xz
7dbfcd846cd83138e547acf750a386af 6734 web optional
roundcube_1.6.20+dfsg-0+deb13u1_source.buildinfo
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEERpy6p3b9sfzUdbME05pJnDwhpVIFAmrYeC8ACgkQ05pJnDwh
pVLusw/9E0/NKOnaOak79G+0fdJgXf/LTK6mMNRwoxqOlmMonSCa2qQdwu2pdN18
XRfGtRloDkQdb4MKoDmTRQ87imp/4TkLyCxbvs+bhwoS/y9U37HQXn0rFuSBxlzV
ciEw2mUuHl4t3sWknEhcTHTDYk6XwObaTBsM7XMieyMxVsBYuYAQRAC8fv3JXWH7
gHTU+5Xe8M90xYwl912uDtGqBPDq1nFLww0n60LmriRQtRoghmIjMivtB7N96Ybh
zRlOCue71bQsdmYj/3SCumBaIZMlKwTfd8kZ0Rpfw2kqDtlvU4Ko4p9wU6ot9ery
ii92r6GWQxRY+CWHjyB582UqvsAB4cSC/4SCAXCikwlUE200eU7oxMOxMyN47hQP
1ixlu4sQjYv34JaSLgFfvWZxQHIsCVFRN3bcW+PMBB5FF52ITC4HcUoO2T4eESC2
+YRIAbdqvlaWd2ACFmM+zxPnEBTEEZesH3nSQ9ENGYfffto4+vOHUOzF+y7HZ6n8
TCRRJogPL1XemBAO1gCUSr0fljfRTytJrO5fkP6uCdc4ZNA1T0pzzMA5FjEa9JD1
aooWBL3URQugJpodIAh/SIX8zOi6gG/a29o11mD+nqulJuoRNjPwNbnhh9GHOAdz
Wljk9P/JqkA/Z8ViuqBUh2sW7SAsfrhC4HbOF4i+Lw06E/R0eOs=
=YPW2
-----END PGP SIGNATURE-----
pgpWUz6oVyJWL.pgp
Description: PGP signature
--- End Message ---
