Version in base suite: 1.6.13+dfsg-0+deb13u1 Base version: roundcube_1.6.13+dfsg-0+deb13u1 Target version: roundcube_1.6.15+dfsg-0+deb13u1 Base file: /srv/ftp-master.debian.org/ftp/pool/main/r/roundcube/roundcube_1.6.13+dfsg-0+deb13u1.dsc Target file: /srv/ftp-master.debian.org/policy/pool/main/r/roundcube/roundcube_1.6.15+dfsg-0+deb13u1.dsc CHANGELOG.md | 18 + composer.json-dist | 3 debian/changelog | 25 + debian/patches/Avoid-dependency-on-new-package-mlocati-ip-lib.patch | 121 ++++++++ debian/patches/Fix-FTBFS-with-phpunit-11.patch | 142 ++++------ debian/patches/fix-install-path.patch | 4 debian/patches/map-sqlite3-to-sqlite.patch | 2 debian/patches/series | 1 debian/patches/update-composer.patch | 14 plugins/password/password.php | 4 program/actions/mail/index.php | 2 program/actions/mail/search.php | 4 program/actions/mail/send.php | 3 program/actions/utils/modcss.php | 2 program/include/iniset.php | 11 program/include/rcmail_action.php | 3 program/lib/Roundcube/db/mysql.php | 5 program/lib/Roundcube/rcube_db.php | 6 program/lib/Roundcube/rcube_utils.php | 48 +++ program/lib/Roundcube/rcube_washtml.php | 46 ++- program/localization/lv_LV/messages.inc | 8 public_html/plugins/password/password.php | 4 tests/Framework/DB.php | 4 tests/Framework/DBMysql.php | 16 - tests/Framework/DBPgsql.php | 8 tests/Framework/Utils.php | 37 ++ tests/Framework/Washtml.php | 41 ++ 27 files changed, 453 insertions(+), 129 deletions(-) dpkg-source: warning: cannot verify inline signature for /srv/release.debian.org/tmp/tmpsxg_4fjm/roundcube_1.6.13+dfsg-0+deb13u1.dsc: no acceptable signature found dpkg-source: warning: cannot verify inline signature for /srv/release.debian.org/tmp/tmpsxg_4fjm/roundcube_1.6.15+dfsg-0+deb13u1.dsc: no acceptable signature found diff -Nru roundcube-1.6.13+dfsg/CHANGELOG.md roundcube-1.6.15+dfsg/CHANGELOG.md --- roundcube-1.6.13+dfsg/CHANGELOG.md 2026-02-08 09:25:02.000000000 +0000 +++ roundcube-1.6.15+dfsg/CHANGELOG.md 2026-03-29 09:45:29.000000000 +0000 @@ -2,6 +2,24 @@ ## Unreleased +- Fix regression where mail search would fail on non-ascii search criteria (#10121) +- Fix regression where some data url images could get ignored/lost (#10128) +- Fix SVG Animate FUNCIRI Attribute Bypass — Remote Image Loading via fill/filter/stroke + +## Release 1.6.14 + +- Fix Postgres connection using IPv6 address (#10104) +- Security: Fix pre-auth arbitrary file write via unsafe deserialization in redis/memcache session handler +- Security: Fix bug where a password could get changed without providing the old password +- Security: Fix IMAP Injection + CSRF bypass in mail search +- Security: Fix remote image blocking bypass via various SVG animate attributes +- Security: Fix remote image blocking bypass via a crafted body background attribute +- Security: Fix fixed position mitigation bypass via use of !important +- Security: Fix XSS issue in a HTML attachment preview +- Security: Fix SSRF + Information Disclosure via stylesheet links to a local network hosts + +## Release 1.6.13 + - Managesieve: Fix handling of string-list format values for date tests in Out of Office (#10075) - Fix remote image blocking bypass via SVG content reported by nullcathedral - Fix CSS injection vulnerability reported by CERT Polska diff -Nru roundcube-1.6.13+dfsg/composer.json-dist roundcube-1.6.15+dfsg/composer.json-dist --- roundcube-1.6.13+dfsg/composer.json-dist 2026-02-08 09:25:02.000000000 +0000 +++ roundcube-1.6.15+dfsg/composer.json-dist 2026-03-29 09:45:29.000000000 +0000 @@ -20,7 +20,8 @@ "roundcube/rtf-html-php": "~2.1", "masterminds/html5": "~2.7.0", "bacon/bacon-qr-code": "^2.0.0", - "guzzlehttp/guzzle": "^7.3.0" + "guzzlehttp/guzzle": "^7.3.0", + "mlocati/ip-lib": "^1.22.0" }, "require-dev": { "phpunit/phpunit": "^9" diff -Nru roundcube-1.6.13+dfsg/debian/changelog roundcube-1.6.15+dfsg/debian/changelog --- roundcube-1.6.13+dfsg/debian/changelog 2026-02-11 09:55:46.000000000 +0000 +++ roundcube-1.6.15+dfsg/debian/changelog 2026-03-30 11:40:22.000000000 +0000 @@ -1,3 +1,28 @@ +roundcube (1.6.15+dfsg-0+deb13u1) trixie-security; urgency=high + + * New upstream security and bugfix release (closes: #1131182, #1132268). + + Fix CVE-2026-35537: Pre-auth arbitrary file write via unsafe + deserialization in redis/memcache session handler. + + Fix CVE-2026-35538: IMAP Injection + CSRF bypass in mail search. + + Fix CVE-2026-35539: XSS vulnerability in HTML attachment preview. + + Fix CVE-2026-35540: SSRF and information disclosure vulnerability via + stylesheet links pointing to a local network hosts. + + Fix CVE-2026-35541: A password could get changed without providing the + old password in some situations. + + Fix CVE-2026-35542: Remote image blocking bypass via a crafted
+ background attribute. + + Fix CVE-2026-35543: Remote image blocking bypass via various SVG animate + attributes. + + Fix CVE-2026-35544: Fixed position mitigation bypass via use of + `!important`. + + Fix CVE-2026-35545: SVG animate FUNCIRI attribute bypass (remote image + loading via fill/filter/stroke). + * Refresh d/patches. + * Add custom patch to avoid runtime dependency on mlocati/ip-lib which is + not present in trixie. + + -- Guilhem Moulina
"; @@ -10961,7 +10951,7 @@ $washed = $washer->wash($html); $this->assertMatchesRegularExpression('|line-height: 1;|', $washed, "Untouched line-height (#1489917)"); -@@ -286,7 +289,7 @@ class Framework_Washtml extends PHPUnit\Framework\TestCase +@@ -293,7 +296,7 @@ class Framework_Washtml extends PHPUnit\Framework\TestCase $html = ""; $expected = ""; @@ -10970,7 +10960,7 @@ $washed = $washer->wash($html); $this->assertSame($this->cleanupResult($washed), $expected, 'White-space and new-line characters handling'); -@@ -300,7 +303,7 @@ class Framework_Washtml extends PHPUnit\Framework\TestCase +@@ -307,7 +310,7 @@ class Framework_Washtml extends PHPUnit\Framework\TestCase $html = "test
"; $washed = $washer->wash($html); -@@ -372,7 +375,7 @@ class Framework_Washtml extends PHPUnit\Framework\TestCase +@@ -379,7 +382,7 @@ class Framework_Washtml extends PHPUnit\Framework\TestCase '; @@ -11006,7 +10996,7 @@ $washed = $washer->wash($svg); $this->assertSame($washed, $exp, "SVG content"); -@@ -381,7 +384,7 @@ class Framework_Washtml extends PHPUnit\Framework\TestCase +@@ -388,7 +391,7 @@ class Framework_Washtml extends PHPUnit\Framework\TestCase /** * Test cases for SVG tests */ @@ -11015,7 +11005,7 @@ { $svg1 = ""; -@@ -508,9 +511,10 @@ class Framework_Washtml extends PHPUnit\Framework\TestCase +@@ -533,9 +536,10 @@ class Framework_Washtml extends PHPUnit\Framework\TestCase * * @dataProvider data_wash_svg_tests */ @@ -11027,7 +11017,7 @@ $washed = $washer->wash($input); $this->assertSame($expected, $this->cleanupResult($washed), "SVG content"); -@@ -519,7 +523,7 @@ class Framework_Washtml extends PHPUnit\Framework\TestCase +@@ -544,7 +548,7 @@ class Framework_Washtml extends PHPUnit\Framework\TestCase /** * Test cases for various XSS issues */ @@ -11036,7 +11026,7 @@ { return [ [ -@@ -574,9 +578,10 @@ class Framework_Washtml extends PHPUnit\Framework\TestCase +@@ -599,9 +603,10 @@ class Framework_Washtml extends PHPUnit\Framework\TestCase * * @dataProvider data_wash_xss_tests */ @@ -11048,7 +11038,7 @@ $washed = $washer->wash($input); $this->assertSame($expected, $this->cleanupResult($washed), "XSS issues"); -@@ -590,7 +595,7 @@ class Framework_Washtml extends PHPUnit\Framework\TestCase +@@ -615,7 +620,7 @@ class Framework_Washtml extends PHPUnit\Framework\TestCase $html = "