-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Wed, 08 Jul 2026 12:46:28 +0200
Source: roundcube
Binary: roundcube roundcube-core roundcube-mysql roundcube-pgsql roundcube-plugins roundcube-sqlite3
Architecture: all
Version: 1.6.17+dfsg-0+deb13u1
Distribution: trixie-security
Urgency: high
Maintainer: all Build Daemon (x86-grnet-02) <buildd_all-x86-grnet-02@buildd.debian.org>
Changed-By: Guilhem Moulin <guilhem@debian.org>
Description:
 roundcube  - skinnable AJAX based webmail solution for IMAP servers - metapack
 roundcube-core - skinnable AJAX based webmail solution for IMAP servers
 roundcube-mysql - metapackage providing MySQL dependencies for RoundCube
 roundcube-pgsql - metapackage providing PostgreSQL dependencies for RoundCube
 roundcube-plugins - skinnable AJAX based webmail solution for IMAP servers - plugins
 roundcube-sqlite3 - metapackage providing SQLite dependencies for RoundCube
Closes: 1138086 1141495
Changes:
 roundcube (1.6.17+dfsg-0+deb13u1) trixie-security; urgency=high
 .
   * New upstream security and bugfix release (closes: #1141495).
     + Fix CVE-2026-62642: Infinite loop in TNEF (winmail.dat) decoder.
     + Fix CVE-2026-62644: Various vulnerabilities in the password plugin using
       session-injected username.
     + Fix CVE-2026-54432: Stored XSS via unescaped attachment MIME type on the
       attachment-validation warning page.
     + Fix CVE-2026-62643: SSRF bypass via specific local address URLs.
     + Fix CVE-2026-54433: Zero-click stored XSS in plain-text rendering.
     + Fix CVE-2026-62641: DoS via crafted compressed-RTF size in the TNEF
       (winmail.dat) file.
     + Enigma: Add support for automatic public key lookup (import) using HKP
       v1 protocol.
     + Enigma: Add support for Kolab's Web Of Anti-Trust (WOAT) feature.
   * d/p/Avoid-dependency-on-new-package-mlocati-ip-lib.patch: Improve patch
     and drop type annotations to restore compatibility with PHP<8 (closes:
     #1138086).
   * Refresh d/patches.
Checksums-Sha1:
 e81736a90dc38523191e6f90a45f59b8266a60cd 4492640 roundcube-core_1.6.17+dfsg-0+deb13u1_all.deb
 7208e49f0932b86936d7af1bac292d44a6bbba00 100532 roundcube-mysql_1.6.17+dfsg-0+deb13u1_all.deb
 5024a1bd4e04c958e5537950593a569a15a71811 100508 roundcube-pgsql_1.6.17+dfsg-0+deb13u1_all.deb
 cda0f71bcc94c082b96079aa20e079f003e2d1f8 783792 roundcube-plugins_1.6.17+dfsg-0+deb13u1_all.deb
 26b992f2d99aba829e8787b074df83426d7204e2 100476 roundcube-sqlite3_1.6.17+dfsg-0+deb13u1_all.deb
 ad79e1f72acf3cc15af92c84b2adc5d23783c877 14130 roundcube_1.6.17+dfsg-0+deb13u1_all-buildd.buildinfo
 26940a57968b5a9a8046a1d9dcc744887ae4299c 1296 roundcube_1.6.17+dfsg-0+deb13u1_all.deb
Checksums-Sha256:
 ecd0eb2d624305f4928f780ae525dd4358327bab6f9ac94e6e1bd2f7b799e5db 4492640 roundcube-core_1.6.17+dfsg-0+deb13u1_all.deb
 80f64b13067becafac9bba1747337876291e90307f45d64bbb795bb8ad6f2584 100532 roundcube-mysql_1.6.17+dfsg-0+deb13u1_all.deb
 85685455eb7ecc13377ea22a87a886f6afbc6aeab348766224f4a659825f7b92 100508 roundcube-pgsql_1.6.17+dfsg-0+deb13u1_all.deb
 453cc0c1ad00cdaf8c7f7913d17ca90116538fa1add5c3d60e33dc083368d063 783792 roundcube-plugins_1.6.17+dfsg-0+deb13u1_all.deb
 e29c16e865fac87930ba96d528c253513a34f8f98b8cb655947ed3620a58683d 100476 roundcube-sqlite3_1.6.17+dfsg-0+deb13u1_all.deb
 05d06bf2062be49669b11acc9d1e806eac7b9347a2e04f9a912181400d5bfe0d 14130 roundcube_1.6.17+dfsg-0+deb13u1_all-buildd.buildinfo
 10f026dbe7d7a9dc5ad708b7588e59044406a9fc209c8c78f12ce52e5b64d5e1 1296 roundcube_1.6.17+dfsg-0+deb13u1_all.deb
Files:
 a6a624454bfac4ad54e88fc430db5c9e 4492640 web optional roundcube-core_1.6.17+dfsg-0+deb13u1_all.deb
 3f2aacc8a929145d555d5d47d393a3ad 100532 web optional roundcube-mysql_1.6.17+dfsg-0+deb13u1_all.deb
 fc6f2e8f73494159fa08acbccb73e55a 100508 web optional roundcube-pgsql_1.6.17+dfsg-0+deb13u1_all.deb
 e8cf1f2def16c1df1fefe5bf76b2a786 783792 web optional roundcube-plugins_1.6.17+dfsg-0+deb13u1_all.deb
 3a81111fe6077385e9cc1ea6c8c8ec59 100476 web optional roundcube-sqlite3_1.6.17+dfsg-0+deb13u1_all.deb
 5dbf853bed9b5cbf94b7523cc9a6a7d1 14130 web optional roundcube_1.6.17+dfsg-0+deb13u1_all-buildd.buildinfo
 3f1b7c7f48dce6d3b6e7387135242d9f 1296 web optional roundcube_1.6.17+dfsg-0+deb13u1_all.deb

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEE81O8NL+3kjBAqEvLmgPNRvTf/zcFAmpZQbYACgkQmgPNRvTf
/zf9LA/+PhoEcwkaPpgarSEyYeaCjUic4UEsC1XN+J2uCw2nlj0Y6/iIvky9pGjy
8Va62J2gIlRE01q5p/0x+hlQpnv923SwfuWF4CtNUlvp1nN15Cpt9r9FIu44cBtF
YZXBvElnAl2bISVBiiND5OMGAFhdldYcKjxCS5a5Dq3kAvznxqw/hZXbJDhLq0OS
RbEajCmOs+Fy+2feDcqPKmB3kPGf+l6qKqeDQ8Kw69p99PWnPMDjMMqZvIHMN2bt
gFOh+wjM1xNKMfuBIKr9D3b52HPzSvociRTW6f81J2tSSue3OKtz4OYKcx5wo82X
KY8qqUhBRV/eK+QSkyxxvfpMPPCgQHfMKsUZsZNaeMEicQbz+jSlEMyxUAwiQs7M
o/VHAd6QXF2PfEXxNGg11ChgpTz4FjuFO2FAV4czPdsbf+m5K5qHONVEUZokMIwm
OqIYM+Gh6aLxKbQMvzUi3AFbCdMvFpBEVykfnueoTw/5i+6G4rEbNu6ZQfrzZSz1
aGmXR3LWXmxNdWtK13CJtXn+PP/jUwooM0MbsuC8i6EuxnNdnzCkoFdJ/lA+D/0E
i3Xi5au0Jlz4vftmLWivbTOfOHnDx4wmsIB9iCQLshOWNqlvzr8Q/pZBmRIHinI9
zL+o1RXIfKJXyqhJnGw9v+r/duPsnCPBpX0K2dy4ixmlHoBXGG4=
=TGqF
-----END PGP SIGNATURE-----