-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
- -------------------------------------------------------------------------
Debian Security Advisory DSA-6196-1 [email protected]
https://www.debian.org/security/ Salvatore Bonaccorso
April 04, 2026 https://www.debian.org/security/faq
- -------------------------------------------------------------------------
Package : roundcube
CVE ID : CVE-2026-35537 CVE-2026-35538 CVE-2026-35539 CVE-2026-35540
CVE-2026-35541 CVE-2026-35542 CVE-2026-35543 CVE-2026-35544
CVE-2026-35545
Debian Bug : 1131182 1132268
Multiple vulnerabilities were discovered in roundcube, a skinnable AJAX
based webmail solution for IMAP servers, which could result in
information disclosure, IMAP injection, CSRF bypass, bypass of remote
image blocking, cross-site scripting, access control bypass, or
privilege escalation.
For the oldstable distribution (bookworm), these problems have been fixed
in version 1.6.5+dfsg-1+deb12u8.
For the stable distribution (trixie), these problems have been fixed in
version 1.6.15+dfsg-0+deb13u1.
We recommend that you upgrade your roundcube packages.
For the detailed security status of roundcube please refer to its
security tracker page at:
https://security-tracker.debian.org/tracker/roundcube
Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/
Mailing list: [email protected]
-----BEGIN PGP SIGNATURE-----
iQKTBAEBCgB9FiEERkRAmAjBceBVMd3uBUy48xNDz0QFAmnRbAFfFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDQ2
NDQ0MDk4MDhDMTcxRTA1NTMxRERFRTA1NENCOEYzMTM0M0NGNDQACgkQBUy48xND
z0SSxA/9GE5A+DyK7fOkwI0gVGT197NlfDYUL1nnwDTyAZgggaWVyXAQkYS1XKCz
g5t9xU7LpdVDSR188rwHgSOwKU9/cxYwuHEL1JKUyJikXUQdv8Txow+Vry7WAVs8
pQLnOPr+pIGKA3awdwqmKuLeGzZt9aY3EV99m7ZPAG7amIaYC2PykrPNEJtvMNbv
/SPiN1/1Gw7G6VVNfxVYhy4DtjFFQ34Ct4593H8sIixDY8akdGEtKiCHGDI5uldE
w5zL4Qg5/qj2M+Gmsd0N+78axaTlWt/p+67W4SUQEyGmAHNFs4JZ1aB6MRcypXta
7YQndm1UFAZ6tlXVNBBrCB/X6Ca2KrwPEddVp960s8AfzOFHojWxj+YJK7tgQU1m
O1oNFzEIWYnN9SRsdvoOoQlJSMO3GM++jXGpxhTuEwpvwSSU0+3IDHurm806OBF9
1JbnimCpbxVlokrTmkix5Vfx2+b3+Ej+Y00uDXejqFLDDBMPv6U3398K/vmUgvE6
3NfxJB1kG79u2LRFOoVvXoBziB61HNZTyHK/HGxDbYMcjXJvEyUo82pXXgRQHVdA
90oQM15RND/NdTaHGFAoqO6vHg3tD7AaP93i+Gh3vOKjnegY25TmYvYlnEwL7DuV
VGMLlsq/6vOyyuc7OU+SByj6iP1ppeIFKANr6tUZSqGgNjmuJsQ=
=YZ+o
-----END PGP SIGNATURE-----
