From foo@bar Thu Oct 15 01:20:05 2026 Format: 1.8 Date: Wed, 14 Oct 2026 23:08:12 +0200 Source: sogo Binary: sogo sogo-activesync sogo-activesync-dbgsym sogo-dbgsym Architecture: sh4 Version: 5.12.12-1 Distribution: sid Urgency: medium Maintainer: sh4 Build Daemon (sh4-osuosl-03) Changed-By: Jordi Mallach Description: sogo - Scalable groupware server sogo-activesync - Scalable groupware server - ActiveSync module Changes: sogo (5.12.12-1) unstable; urgency=medium . * New upstream release with security bugfixes: - IDOR in the contact search endpoint - possible header injection through generated Message-Id domains * Cherry-pick upstream security fixes from master: - session_key_base64_check.patch: possible SQL injection via session key - draft_path_traversal.patch: path traversal through draft names - bydaymask_buffer_overflow.patch: stack overflow parsing BYDAY rules - ldap_filter_escaping.patch: LDAP filter injection * Update source lintian overrides for CKEditor 5 and long lines. * Do not ship the CKEditor sample page and build files. * Drop dependency on obsolete lsb-base. * Do not recursively change log and spool directory permissions in postinst. * Do not activate the ldconfig trigger for private libraries. * Override lintian tags for bundled Material Icons font and CKEditor 5. * Add DEP-3 headers to patches missing a description. * Drop disable_isIpv4_test.patch, fixed upstream, and refresh the rest. * Fix removal of unvendored angular modules, brace expansion needs bash. * Override privacy-breach-generic for CKEditor embeds and angular-material docs. * Update copyright for CKEditor 5. * Move arch-dependent API bundle from sogo-common to sogo. * Add missing "New upstream release" entry to previous entry. * Document security fixes and CVE ids in previous entries. Checksums-Sha1: e872a1858c1f7b9aaea3aaad6875233902763908 105008 sogo-activesync-dbgsym_5.12.12-1_sh4.deb 2937738e0f0b1c9942983c691822f31d00f805c7 273168 sogo-activesync_5.12.12-1_sh4.deb 2213a2b8f5586379eeb81c1bf9892fbba78688df 1253388 sogo-dbgsym_5.12.12-1_sh4.deb fab5a6deb186dda34d2fe7727303fc8f47fdc6fa 12641 sogo_5.12.12-1_sh4.buildinfo 172b3f10a77b33727df55ab57279cd0d23f783d5 1525624 sogo_5.12.12-1_sh4.deb Checksums-Sha256: 12f2040e648e6b369a4754161568cbf3b1cfca6a6436a9e2fb22f99af98e7640 105008 sogo-activesync-dbgsym_5.12.12-1_sh4.deb 43de5ba34805e0164eb7ef5b99a7fa008b09952afb5d5ed3e7389fe8d8a9f9dc 273168 sogo-activesync_5.12.12-1_sh4.deb cefc45101b6cda5b2b7652700e7d99895323c2774295e21e0cf9483e8c9fce24 1253388 sogo-dbgsym_5.12.12-1_sh4.deb f63c4da189235620afd8631b23bc65540cde2c7fd8499990564db04627592070 12641 sogo_5.12.12-1_sh4.buildinfo 1f689223180320bc39fc55e33df5274358a35155cdff73b30b83bba0a6c0f478 1525624 sogo_5.12.12-1_sh4.deb Files: de8a8a0940404f88375328891f2f9925 105008 debug optional sogo-activesync-dbgsym_5.12.12-1_sh4.deb c34921ff4f5bb5b3d99970e65eabcfcf 273168 mail optional sogo-activesync_5.12.12-1_sh4.deb 7ab5538bd1e012e5df91a4ade1632865 1253388 debug optional sogo-dbgsym_5.12.12-1_sh4.deb 5584a6090c21935ec8c24a33661f301a 12641 mail optional sogo_5.12.12-1_sh4.buildinfo 5b0fb7bfd8c4e89677f257affda728d9 1525624 mail optional sogo_5.12.12-1_sh4.deb Signed-By: Debian buildd autosigning key for sh4-osuosl-03