Hi Guilhem, thanks for the clarification.
Just to make sure I understand the current situation correctly: Does this mean that all Roundcube installations using the currently available Debian 12 and Debian 13 packages are currently vulnerable to at least some of the issues fixed in Roundcube 1.6.19? And is my understanding correct that the updates for bookworm and trixie have effectively been held back while waiting for CVE IDs to be assigned? I am asking because this would mean that known security issues remain unfixed in the supported Debian packages for the time being, even though upstream fixes are already available. Is waiting for CVE assignment before publishing such updates normal Debian security practice in this situation, or is this an exceptional case? Best regards Björn ________________________________ Von: Guilhem Moulin <[email protected]> Gesendet: Dienstag, 29. September 2026 14:43 An: Björn Wiggert (wiggert.it); [email protected] Betreff: Re: Bug#1146838: planned updates for bookworm and trixie? Hi, On Tue, 29 Sep 2026 at 11:53:51 +0000, Björn Wiggert (wiggert.it) wrote: > Are updates planned for the supported stable releases as well? > > In particular: > > * Is a security/LTS update such as 1.6.5+dfsg-1+deb12u12 planned for > bookworm? > * Is an update for trixie planned, e.g. via trixie-security or a point > update? Yes. > * If so, is there already an approximate plan or package being prepared? I was waiting for the CVE IDs to be assigned, but given it didn't happen yet 3 weeks after the assignment request it might be worth issuing the updates without CVE IDs. -- Guilhem.
