Debian alert DSA-6196-1 (roundcube)

From:
             
 
Salvatore Bonaccorso <carnil@debian.org>
To:
             
 
debian-security-announce@lists.debian.org
Subject:
             
 
[SECURITY] [DSA 6196-1] roundcube security update
Date:
             
 
Sat, 04 Apr 2026 19:53:20 +0000
Message-ID:
             
 
<E1w973Y-00000005KkG-3hn6@seger.debian.org>
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

- -------------------------------------------------------------------------
Debian Security Advisory DSA-6196-1                   security@debian.org
https://www.debian.org/security/                     Salvatore Bonaccorso
April 04, 2026                        https://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package        : roundcube
CVE ID         : CVE-2026-35537 CVE-2026-35538 CVE-2026-35539 CVE-2026-35540
                 CVE-2026-35541 CVE-2026-35542 CVE-2026-35543 CVE-2026-35544
                 CVE-2026-35545
Debian Bug     : 1131182 1132268

Multiple vulnerabilities were discovered in roundcube, a skinnable AJAX
based webmail solution for IMAP servers, which could result in
information disclosure, IMAP injection, CSRF bypass, bypass of remote
image blocking, cross-site scripting, access control bypass, or
privilege escalation.

For the oldstable distribution (bookworm), these problems have been fixed
in version 1.6.5+dfsg-1+deb12u8.

For the stable distribution (trixie), these problems have been fixed in
version 1.6.15+dfsg-0+deb13u1.

We recommend that you upgrade your roundcube packages.

For the detailed security status of roundcube please refer to its
security tracker page at:
https://security-tracker.debian.org/tracker/roundcube

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

Mailing list: debian-security-announce@lists.debian.org
-----BEGIN PGP SIGNATURE-----

iQKTBAEBCgB9FiEERkRAmAjBceBVMd3uBUy48xNDz0QFAmnRbAFfFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDQ2
NDQ0MDk4MDhDMTcxRTA1NTMxRERFRTA1NENCOEYzMTM0M0NGNDQACgkQBUy48xND
z0SSxA/9GE5A+DyK7fOkwI0gVGT197NlfDYUL1nnwDTyAZgggaWVyXAQkYS1XKCz
g5t9xU7LpdVDSR188rwHgSOwKU9/cxYwuHEL1JKUyJikXUQdv8Txow+Vry7WAVs8
pQLnOPr+pIGKA3awdwqmKuLeGzZt9aY3EV99m7ZPAG7amIaYC2PykrPNEJtvMNbv
/SPiN1/1Gw7G6VVNfxVYhy4DtjFFQ34Ct4593H8sIixDY8akdGEtKiCHGDI5uldE
w5zL4Qg5/qj2M+Gmsd0N+78axaTlWt/p+67W4SUQEyGmAHNFs4JZ1aB6MRcypXta
7YQndm1UFAZ6tlXVNBBrCB/X6Ca2KrwPEddVp960s8AfzOFHojWxj+YJK7tgQU1m
O1oNFzEIWYnN9SRsdvoOoQlJSMO3GM++jXGpxhTuEwpvwSSU0+3IDHurm806OBF9
1JbnimCpbxVlokrTmkix5Vfx2+b3+Ej+Y00uDXejqFLDDBMPv6U3398K/vmUgvE6
3NfxJB1kG79u2LRFOoVvXoBziB61HNZTyHK/HGxDbYMcjXJvEyUo82pXXgRQHVdA
90oQM15RND/NdTaHGFAoqO6vHg3tD7AaP93i+Gh3vOKjnegY25TmYvYlnEwL7DuV
VGMLlsq/6vOyyuc7OU+SByj6iP1ppeIFKANr6tUZSqGgNjmuJsQ=
=YZ+o
-----END PGP SIGNATURE-----