-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Fri, 06 Jun 2025 20:34:20 +0200
Source: roundcube
Architecture: source
Version: 1.4.15+dfsg.1-1+deb11u5
Distribution: bullseye-security
Urgency: high
Maintainer: Debian Roundcube Maintainers <pkg-roundcube-maintainers@alioth-lists.debian.net>
Changed-By: Guilhem Moulin <guilhem@debian.org>
Closes: 1107073
Changes:
roundcube (1.4.15+dfsg.1-1+deb11u5) bullseye-security; urgency=high
.
* Fix CVE-2025-49113: Post-Auth RCE via PHP Object Deserialization.
(Closes: #1107073)
* Regression fix: The fix for CVE-2024-42010 caused some HTML messages to be
displayed unstyled.
* Improve d/p/CVE-2024-37384.patch to use get_input_string() rather than
get_input_value() for consistency with the upstream change.
Checksums-Sha1:
785d8ea444d24c45529307a9fb3649e285cfcff8 3276 roundcube_1.4.15+dfsg.1-1+deb11u5.dsc
7057c9779feeb7852288b6bd4d9c926a5ba75308 112136 roundcube_1.4.15+dfsg.1-1+deb11u5.debian.tar.xz
31f2cff5cc14b202811ef2b6d6400a1680d9d77f 10882 roundcube_1.4.15+dfsg.1-1+deb11u5_amd64.buildinfo
Checksums-Sha256:
304e0c56923398600ad9d07f3300d34e5feea15ebef0bedb724be8ba6281bf7a 3276 roundcube_1.4.15+dfsg.1-1+deb11u5.dsc
de287f435cdf80940df4e83ca89dac8fb41e1c2d21d1c1e0cf602a2d8ac7d844 112136 roundcube_1.4.15+dfsg.1-1+deb11u5.debian.tar.xz
3e254aa728f4b0033ba0118a6ea59cd495cd1f670e8312a87d5acadbe9a33609 10882 roundcube_1.4.15+dfsg.1-1+deb11u5_amd64.buildinfo
Files:
e4ca4a037409abf853c2173e78315cc1 3276 web optional roundcube_1.4.15+dfsg.1-1+deb11u5.dsc
3966dc08cf45c780f255c7d98fbcec50 112136 web optional roundcube_1.4.15+dfsg.1-1+deb11u5.debian.tar.xz
f75b7d23de0faeee932229808c820b15 10882 web optional roundcube_1.4.15+dfsg.1-1+deb11u5_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEERpy6p3b9sfzUdbME05pJnDwhpVIFAmhGM8cACgkQ05pJnDwh
pVKf+g/+JPcgOId0L4TW/h2R6AZYJc5emyr9y9GYUBBfUb1hT5kbHIbXZarfqu5G
ZzbQtVT7qsI+BQwgKkVuAqvf0evYGwhdC26y0+hTgiuGTgp9jbpEtDcVay2GXzWk
3zDy+9HVXrUWX4isB8IIWMe2yEQSMpUqT1OXMWd0SBGoAoPT1yEC+TPNNE+cX2AC
c/lxKP2wpbJBWtubAmH07/prHQ98bAoicqveKcdXlcSJwFlvwWWIchtALErnyf6C
Pt3QIGzNnBEA4mFcNmuqlz9BmyeMzDujd7b8g6ncLDPcOMz8XNwkOsMPw/nt2Vl7
cT/p34zgs/QrnAwN76citDmUIt81iD+uPlwIR7MMnbXWnwvVHQZanS34+oQGrnNL
V69Wrr6W3avKlNmtf0dg0d5uDqxzPjTg46VWA3iRYmI6Ahee49K3Kn3HnmwzC/vT
Yofo9fDlyRggRmTdBYPUtIjlJsWi6rlnjfDUQGAKFh/5WJ1RoeYrMRsAJc+wmM8j
VLVCQCD0ywfj+f8XwN+Khyh0uMieRWzLQ3w8LH04yTnIhZR+XEwwgpuERqGamZX/
Oyk06yzfHx1djojdJkQ31oHYMKi3ac4E3GtScrJ7KkpgoUkFVdm7vLz88x+cTtB0
ApOb4dJINTO1hx6iNuWeGjqkW6TyVW66qvfVOskph3KO3YTLLok=
=yI8A
-----END PGP SIGNATURE-----
Attachment:
pgpT6JERPcWCO.pgp
Description: PGP signature