Your message dated Mon, 31 Aug 2026 13:48:53 +0000
with message-id <[email protected]>
and subject line Bug#1144059: fixed in roundcube 1.6.18+dfsg-0+deb13u1
has caused the Debian Bug report #1144059,
regarding roundcube: Multiple security vulnerabilities
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1144059: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1144059
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: roundcube
Version: 1.6.17+dfsg-1
Control: found -1 1.6.17+dfsg-0+deb13u1
Control: found -1 1.6.5+dfsg-1+deb12u10
Control: found -1 1.4.15+dfsg.1-1+deb11u10
Severity: grave
Tags: security upstream
Justification: user security hole
X-Debbugs-Cc: Debian Security Team <[email protected]>
Roundcube webmail upstream has recently released 1.6.17 [0] which fixes
the following security vulnerabilities:
1. Content proxied by the css proxy is not validated validation
https://github.com/roundcube/roundcubemail/commit/62d33c8a0dc3fd0dd03984220dc9709e8e0de43b
2. SSRF bypass via specific local address URLs using 100.64.0.0/10 and
fe80::/10 subnets
https://github.com/roundcube/roundcubemail/commit/8a92380b06b5df1481e034c4f40d6a6546c21223
3. SSRF filter bypass via various forms of nip.io/sslip.io hostnames
evading is_local_url() check
https://github.com/roundcube/roundcubemail/commit/92f85c883594e5be757154f94548a9ba903455c9
4. Remote content blocking bypass via unclosed url() in a FuncIRI
attribute
https://github.com/roundcube/roundcubemail/commit/1cebea03474305d9f75a9a33d30880d290b5591b
5. LDAP filter injection via unescaped %u/%fu/%d substitution into the
`search_filter`
https://github.com/roundcube/roundcubemail/commit/e6cc1e121effeaec6d916feb4e019d2828924540
6. Arbitrary sieve script injection via a filter rule name bypassing
`managesieve_disabled_actions`
https://github.com/roundcube/roundcubemail/commit/a1afb8fd1f00ed4cb9376c072bb5ca5ded64495e
7. RCE in the `cmd_learn` driver of markasjunk plugin
https://github.com/roundcube/roundcubemail/commit/b8f90e28a46d42e79a69568cba897f8f4223d9cd
Follow-up:
https://github.com/roundcube/roundcubemail/commit/495d211638f222336b20f4744545c53712426c2a
8. IMAP command injection via mail search and LITERAL+ byte-count
desynchronization
https://github.com/roundcube/roundcubemail/commit/73233abe581b3b31cefd00041c7086c40e1793ea
9. The modoboa driver of the passwd plugin leaks an authentication
token to a user-controlled host
https://github.com/roundcube/roundcubemail/commit/65b8ea9d8304b10f1d3bda5bcc82f9c682cf804c
10. Stored XSS in “Add to address book” action
https://github.com/roundcube/roundcubemail/commit/32f20c6bfd12dff9cfb6880ae303e740f0804fe8
11. HTML/CSS sanitization bypass via SVG animate `by` attribute
https://github.com/roundcube/roundcubemail/commit/4a2bb87d9ea93578acb9bb03599abf754c33a33f
(Using severity=grave due to issues #7 and #9, although they are
specific to plugins which are not enabled by default.)
AFAIK no CVE-ID have been published for these issues. I'll request some
later today unless someone beats me to it.
--
Guilhem.
[0] https://roundcube.net/news/2026/08/09/security-updates-1.6.18-and-1.7.3
signature.asc
Description: PGP signature
--- End Message ---
--- Begin Message ---
Source: roundcube
Source-Version: 1.6.18+dfsg-0+deb13u1
Done: Guilhem Moulin <[email protected]>
We believe that the bug you reported is fixed in the latest version of
roundcube, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Guilhem Moulin <[email protected]> (supplier of updated roundcube package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Mon, 10 Aug 2026 15:45:10 +0200
Source: roundcube
Architecture: source
Version: 1.6.18+dfsg-0+deb13u1
Distribution: trixie-security
Urgency: high
Maintainer: Debian Roundcube Maintainers
<[email protected]>
Changed-By: Guilhem Moulin <[email protected]>
Closes: 1144059
Changes:
roundcube (1.6.18+dfsg-0+deb13u1) trixie-security; urgency=high
.
* New upstream security and bugfix release (closes: #1144059).
+ Fix CVE-2026-74998: Content proxied by the css proxy is not validated
validation.
+ Fix CVE-2026-75006: SSRF bypass via specific local address URLs using
100.64.0.0/10 and fe80::/10 subnets.
+ Fix CVE-2026-75006: SSRF filter bypass via various forms of
nip.io/sslip.io hostnames evading `is_local_url()` check.
+ Fix CVE-2026-75003: Remote content blocking bypass via unclosed `url()`
in a FuncIRI attribute.
+ Fix CVE-2026-75007: LDAP filter injection via unescaped %u/%fu/%d
substitution into the `search_filter`.
+ Fix CVE-2026-75004: Arbitrary sieve script injection via a filter rule
name bypassing `managesieve_disabled_actions`.
+ Fix CVE-2026-74997: RCE in the `cmd_learn` driver of markasjunk plugin.
+ Fix CVE-2026-75002: IMAP command injection via mail search and LITERAL+
byte-count desynchronization.
+ Fix CVE-2026-75010: The modoboa driver of the passwd plugin leaks an
authentication token to a user-controlled host.
+ Fix CVE-2026-74999: Stored XSS in "Add to address book" action.
+ Fix CVE-2026-75000: HTML/CSS sanitization bypass via SVG animate `by`
attribute.
* Refresh d/patches.
* Cherry-pick follow-up change to fix PHP warning in markasjunk's
cmd_learn.php.
Checksums-Sha1:
08e65ba30642d917165c92b6dc541f0f79061372 3860
roundcube_1.6.18+dfsg-0+deb13u1.dsc
d1f446017c4ecc7d79a0ea6b465feb3fbee7b9c7 126948
roundcube_1.6.18+dfsg.orig-tinymce-langs.tar.xz
af0bba30402c4c02beaca3ae96ac6aa12a4a6da6 1928640
roundcube_1.6.18+dfsg.orig-tinymce.tar.xz
2b80f406956df4da1213893520778b94814aacd0 2907948
roundcube_1.6.18+dfsg.orig.tar.xz
baff8be4efdca960813d738101b458fcc42b1915 158552
roundcube_1.6.18+dfsg-0+deb13u1.debian.tar.xz
9086f022f790a7080109ade691905dd46f973c26 6268
roundcube_1.6.18+dfsg-0+deb13u1_source.buildinfo
Checksums-Sha256:
79ef25e48f71d319a944019a8de929aec59d79ebcb092b0d3078fbb345bf63fb 3860
roundcube_1.6.18+dfsg-0+deb13u1.dsc
f009f44443e465cd7a06a758cb878402868f61b47762bf247f572fd2b3fd1bfb 126948
roundcube_1.6.18+dfsg.orig-tinymce-langs.tar.xz
518547256094a0214580e18b22693cc63d54dd059d8a8116a967898c854a7acb 1928640
roundcube_1.6.18+dfsg.orig-tinymce.tar.xz
b413364d67014758eb4a4b87adc2a0f465e0a0bedf23d644d61955280f1df900 2907948
roundcube_1.6.18+dfsg.orig.tar.xz
b7633afa3585660a1822ae35d52769e72171cddd93504b8e5daf52de8ec91647 158552
roundcube_1.6.18+dfsg-0+deb13u1.debian.tar.xz
9979329dc63c4fd35fb7a1253156b9126f7aa5f6e975ad234b234638423e64bc 6268
roundcube_1.6.18+dfsg-0+deb13u1_source.buildinfo
Files:
6295d7a0660cedfb8a2338d47522dcf6 3860 web optional
roundcube_1.6.18+dfsg-0+deb13u1.dsc
6d1099a82016ca3d45dbba79295f6e30 126948 web optional
roundcube_1.6.18+dfsg.orig-tinymce-langs.tar.xz
49949888729c8204636bc14cffcfa003 1928640 web optional
roundcube_1.6.18+dfsg.orig-tinymce.tar.xz
8e988bb1541cf388be0bd2630e01dc90 2907948 web optional
roundcube_1.6.18+dfsg.orig.tar.xz
ec90317e38388b990bb8d2c72ee987d3 158552 web optional
roundcube_1.6.18+dfsg-0+deb13u1.debian.tar.xz
44e997bc4fadda5f2d94ebb734ecb806 6268 web optional
roundcube_1.6.18+dfsg-0+deb13u1_source.buildinfo
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEERpy6p3b9sfzUdbME05pJnDwhpVIFAmqTSm4ACgkQ05pJnDwh
pVKo8A/+Nyd6r3swZL1AuMynQRbvhNUZBsZBFoV+19rNT/UJCFQIS+jgibz9eM9z
XZxfn/Tsysr6PC4iTjz3PKNSdMVatC8bv9vi138USazNabDL8oukSz1mYCyab/zY
kiQpku9KoY32CFbGOsF++lqq84QEXdqSg+rt+7PVgauyojyAND4FRAk3Ryo7FIam
dlNNJ6n9suLpA5AzIKKJU9s6u3PJrG65+4ij/9wBs3IC2n0o5MH0TURYcHnSmFeV
uBwOo6NJDkG9siGtj3p9+njZ1n8ouUzjX2Gfyn8tlT7DOSP6ZcAKUCqXCIir7gTm
ouJSnT0Unw2bmcGVrJngFZqgOdoaB//8Lgbf/qpQL9cp3Lh2/KJPBYxfCRx990UP
O/HirrLikSm5/CUlcHp3N660TvCXHuI+wPJniy4SDzrpFJ+vDFUyGtW/geCHDklq
u4ZS1IW5ghxuv0pPiEq4HvmGFx1obBJmiwFShL/C1VCjhg8wb198DCl2I0N5bQ63
yekaRAVFZ0OioC9AsGvuWa1CyTvDZglKz+u+EgmE86Pim/B1XDhSSTR+YrMAP4PH
pOKHmuEaTxMCsFGX9NjGQJTglv25qadcrJjnLxK+52e8OuAwkg9IiZTWPKkB6OWk
5oyFoCwOl3bNExmnn3kqANqMkljlwA+ZxutCHjPDbQ6SsTUTouE=
=YnPQ
-----END PGP SIGNATURE-----
pgpD7lYsEYQWc.pgp
Description: PGP signature
--- End Message ---
