-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Mon, 31 Aug 2026 16:45:55 +0200
Source: cyrus-imapd
Binary: cyrus-admin cyrus-admin-dbgsym cyrus-caldav cyrus-caldav-dbgsym cyrus-clients cyrus-clients-dbgsym cyrus-common cyrus-common-dbgsym cyrus-dev cyrus-doc cyrus-imapd cyrus-imapd-dbgsym cyrus-murder cyrus-murder-dbgsym cyrus-nntpd cyrus-nntpd-dbgsym cyrus-pop3d cyrus-pop3d-dbgsym cyrus-replication cyrus-replication-dbgsym libcyrus-imap-perl libcyrus-imap-perl-dbgsym
Architecture: source amd64 all
Version: 3.6.1-4+deb12u5
Distribution: bookworm-security
Urgency: high
Maintainer: Debian Cyrus Team <team+cyrus@tracker.debian.org>
Changed-By: Edmund Lodewijks <edmund@proteamail.com>
Description:
cyrus-admin - Cyrus mail system - administration tools
cyrus-caldav - Cyrus mail system - CalDAV and CardDAV support
cyrus-clients - Cyrus mail system - test clients
cyrus-common - Cyrus mail system - common files
cyrus-dev - Cyrus mail system - developer files
cyrus-doc - Cyrus mail system - documentation files
cyrus-imapd - Cyrus mail system - IMAP support
cyrus-murder - Cyrus mail system - proxies and aggregator
cyrus-nntpd - Cyrus mail system - NNTP support
cyrus-pop3d - Cyrus mail system - POP3 support
cyrus-replication - Cyrus mail system - replication
libcyrus-imap-perl - Interface to Cyrus imap client imclient library
Changes:
cyrus-imapd (3.6.1-4+deb12u5) bookworm-security; urgency=high
.
* Backport security fixes released in upstream 3.10.3 to 3.6, which
upstream no longer supports
(https://www.cyrusimap.org/imap/download/release-notes/3.10/x/3.10.3.html):
- CVE-2026-47084: LOCALDELETE bypassed ACL checks, allowing non-admin
users to delete mailboxes without permission.
- CVE-2026-47086: GENURLAUTH issued URLAUTH tokens without checking
ACL_READ on the target mailbox.
- CVE-2026-47087: URLAUTH tokens kept working after the authorizer's
access was revoked.
- CVE-2026-47081: XAPPLEPUSHSERVICE allowed probing for mailbox
existence and hijacking push notifications on other users' folders.
- CVE-2026-47089: LISTRIGHTS was not restricted to users with admin
access on the target mailbox.
- CVE-2026-47085: URLAUTH tokens could be forged via a predictable
empty mboxkey.
- CVE-2026-47088: heap out-of-bounds read when parsing nested MIME
comments in RFC 822 headers.
- CVE-2026-47082: vacation "fcc" delivery skipped the ACL check on the
destination mailbox.
Checksums-Sha1:
4898ef78231512ae6d3fe538cd0e7ecfd7f39615 5489 cyrus-imapd_3.6.1-4+deb12u5.dsc
5c67eb64258c79da1efea09357ef1d9fbbd2174b 115168 cyrus-imapd_3.6.1-4+deb12u5.debian.tar.xz
64fa951799a58f75e7b698408e955dd0373faf34 34452 cyrus-admin-dbgsym_3.6.1-4+deb12u5_amd64.deb
a3745124101b598d7d9d6365e50a19d82e85b03a 80612 cyrus-admin_3.6.1-4+deb12u5_amd64.deb
0cc7d214ccbfc93c4519568e0bf9bc19aa69e64b 1619800 cyrus-caldav-dbgsym_3.6.1-4+deb12u5_amd64.deb
e9cfd5c19866aa67a043197c84a1a8e20ce12d3c 596568 cyrus-caldav_3.6.1-4+deb12u5_amd64.deb
67db9b72128cec8bd42a9c9e6ed37d90baee9368 59276 cyrus-clients-dbgsym_3.6.1-4+deb12u5_amd64.deb
67f92b299d4f088b8df0238488a99701d1903dbf 88196 cyrus-clients_3.6.1-4+deb12u5_amd64.deb
f21201516428b56882e72dfca8663a575f609748 4100512 cyrus-common-dbgsym_3.6.1-4+deb12u5_amd64.deb
c6f233125d1b561218adc411752420dd5e568c55 1312340 cyrus-common_3.6.1-4+deb12u5_amd64.deb
158984931278fb29466caf1e06007557fc5e7074 87580 cyrus-dev_3.6.1-4+deb12u5_amd64.deb
2f2f57b29997a11be2f22c4d97d0b24636f0b17d 290296 cyrus-doc_3.6.1-4+deb12u5_all.deb
5744a7ab30022fecbfd9409f27457a36ee5c67bd 416440 cyrus-imapd-dbgsym_3.6.1-4+deb12u5_amd64.deb
da994ad7b911d4808f80b2c328a6d188a21e4250 17885 cyrus-imapd_3.6.1-4+deb12u5_amd64.buildinfo
e9a39be430c32cbeb605a984ff5903f1123b2538 209988 cyrus-imapd_3.6.1-4+deb12u5_amd64.deb
47def04cc08dfde2d5960b8f4b110a27ed8090e7 64832 cyrus-murder-dbgsym_3.6.1-4+deb12u5_amd64.deb
03819996b278da3f0091fb2198b5c711619752eb 74172 cyrus-murder_3.6.1-4+deb12u5_amd64.deb
a91cd77ff876cc6c84dc2e80994e523ec56f7f5d 247728 cyrus-nntpd-dbgsym_3.6.1-4+deb12u5_amd64.deb
9f5d73a811036b7e522fcc77a65520c9d8d9bfb3 142444 cyrus-nntpd_3.6.1-4+deb12u5_amd64.deb
2fdfd7c94b5b75bfcfbccb0312309be87fa0006e 195376 cyrus-pop3d-dbgsym_3.6.1-4+deb12u5_amd64.deb
2aa00b27cca2d5089ec19b23f0acb70a0cef799f 121700 cyrus-pop3d_3.6.1-4+deb12u5_amd64.deb
290056fd95e7bc31594af8c43ec9a81e03f0f5e9 426756 cyrus-replication-dbgsym_3.6.1-4+deb12u5_amd64.deb
795d4bb1e0da9742f15d097dbb4123089e899775 143124 cyrus-replication_3.6.1-4+deb12u5_amd64.deb
79d4a93bc87bf2670ef69826f79bf0e8c33cfbbf 438760 libcyrus-imap-perl-dbgsym_3.6.1-4+deb12u5_amd64.deb
1c1f9db8ea96bce083955aef920c9ddb797abf6c 272844 libcyrus-imap-perl_3.6.1-4+deb12u5_amd64.deb
Checksums-Sha256:
976a2a0b60086d34cc085bf1698253edd18f3074b7c1e8759d66c380d479ca64 5489 cyrus-imapd_3.6.1-4+deb12u5.dsc
38c45033f7b9e1453275f943724db5fd54bf04828b660d3ebbbb423f6119bb88 115168 cyrus-imapd_3.6.1-4+deb12u5.debian.tar.xz
5abc66e73f9f0316ea5ce4568379adbf33e78adcfb29069c3293579c00b1aa0e 34452 cyrus-admin-dbgsym_3.6.1-4+deb12u5_amd64.deb
6e7ac6eeebb59a535721ff50e033a0c769c2fa4a1801b6b0f20293d036cd620c 80612 cyrus-admin_3.6.1-4+deb12u5_amd64.deb
3cf75602abb815c46cea3ff62832aa1a69d214625a6b3c90f617388a6c08a646 1619800 cyrus-caldav-dbgsym_3.6.1-4+deb12u5_amd64.deb
09ecd7229a94f6fc1500b793e20cd093892b46205f108cbd89f9f7d633eeb259 596568 cyrus-caldav_3.6.1-4+deb12u5_amd64.deb
90729282dc5575baee57d67750dbd2ea4c62c752c88359494d939666cdf8ff9e 59276 cyrus-clients-dbgsym_3.6.1-4+deb12u5_amd64.deb
779150bca2cf5095c83adf7d3bfed6df5f8ef2dff36cc37dc8bb672631b26314 88196 cyrus-clients_3.6.1-4+deb12u5_amd64.deb
d7a62497509609c206a9427f75678905ee0ff834c5b4054663eba32e759d2216 4100512 cyrus-common-dbgsym_3.6.1-4+deb12u5_amd64.deb
8942cc255ad72da2b8a505e6797cb239ba99c00deb03ecee8ac12d1500588b04 1312340 cyrus-common_3.6.1-4+deb12u5_amd64.deb
0c466468deece373ced08a7954860ff589b8ab889d935f84906500194882c995 87580 cyrus-dev_3.6.1-4+deb12u5_amd64.deb
71dcca376aa01e133b1b13804fbe1bc990c175b796afc99ddd3a00da5bc295d1 290296 cyrus-doc_3.6.1-4+deb12u5_all.deb
ae4a04f98374539241764720879994ac5f6bf981334a28eb1c16ef18f6b7c740 416440 cyrus-imapd-dbgsym_3.6.1-4+deb12u5_amd64.deb
2a0d0ef1db46da52defcf8478701a98e3da330550888c622274067e3a3da2a85 17885 cyrus-imapd_3.6.1-4+deb12u5_amd64.buildinfo
a492cb3ad577026b378cad9070dc93b8533be53d43301c481b00d7f721623a23 209988 cyrus-imapd_3.6.1-4+deb12u5_amd64.deb
dec92a59ea3e1de02dbaf1af121d73cedce75e794982945630064ef73879b518 64832 cyrus-murder-dbgsym_3.6.1-4+deb12u5_amd64.deb
eb10f06d27b318e8a4dc85d2348e38dc5ed0e13072ff16881156197bc06a6b40 74172 cyrus-murder_3.6.1-4+deb12u5_amd64.deb
02c12f3d3462b701b72a7538e2ef542fa198a6ff4854ca36b1fde79b139eace0 247728 cyrus-nntpd-dbgsym_3.6.1-4+deb12u5_amd64.deb
2d537375160e36286d986134d866b3db7dbdacb14205f25e36a6a8d989857acc 142444 cyrus-nntpd_3.6.1-4+deb12u5_amd64.deb
cb5ede06f8877d207ead6ff4a1212dfa4c9444b016e9f6e18645ff63f083aa14 195376 cyrus-pop3d-dbgsym_3.6.1-4+deb12u5_amd64.deb
0cb7644eada6f45b862ec6d815e68fcbd6d96aa0df6b0eadd9f4a688d5cb7eea 121700 cyrus-pop3d_3.6.1-4+deb12u5_amd64.deb
65a3e2ab16c2688550d17c6f8e0dfe66e6806980b167527c931d8321a0c66087 426756 cyrus-replication-dbgsym_3.6.1-4+deb12u5_amd64.deb
1d77befdd2ff48714a7401171772f515b18779649a87c7458466ae1358373697 143124 cyrus-replication_3.6.1-4+deb12u5_amd64.deb
9e65d5b75dee42241a39d8d554ac045512554f159bbd65a89e558f6b00e13765 438760 libcyrus-imap-perl-dbgsym_3.6.1-4+deb12u5_amd64.deb
9ae7bd4ce5dbdc8c3a7429c0595de061e716d1ef9ffaa0b1a04801d651d6274f 272844 libcyrus-imap-perl_3.6.1-4+deb12u5_amd64.deb
Files:
90b20accd563a60b88731fc21faa6405 5489 mail optional cyrus-imapd_3.6.1-4+deb12u5.dsc
a07a8a9dd28811e377ccc514a063f396 115168 mail optional cyrus-imapd_3.6.1-4+deb12u5.debian.tar.xz
b71a81121acd1dd24c07fd35f6e89707 34452 debug optional cyrus-admin-dbgsym_3.6.1-4+deb12u5_amd64.deb
d90abeecf0de98cfda217fb7bba9f253 80612 mail optional cyrus-admin_3.6.1-4+deb12u5_amd64.deb
41a27db9b88340ffeabb112310c77884 1619800 debug optional cyrus-caldav-dbgsym_3.6.1-4+deb12u5_amd64.deb
083c7e523e789415fd7e1f0aa0c38c6d 596568 mail optional cyrus-caldav_3.6.1-4+deb12u5_amd64.deb
8c99745c72d6f42c6921729b35f49f50 59276 debug optional cyrus-clients-dbgsym_3.6.1-4+deb12u5_amd64.deb
5b0754385a9b6b5b7419fbec1c119a10 88196 mail optional cyrus-clients_3.6.1-4+deb12u5_amd64.deb
34078b3b7f506dca61184da01ee535d1 4100512 debug optional cyrus-common-dbgsym_3.6.1-4+deb12u5_amd64.deb
7740e861d6174fdc7747645593416287 1312340 mail optional cyrus-common_3.6.1-4+deb12u5_amd64.deb
dbe5769f07a61c44d16dbdf157fc5573 87580 devel optional cyrus-dev_3.6.1-4+deb12u5_amd64.deb
6f070a7d6435c051fc15d6ba710389a4 290296 doc optional cyrus-doc_3.6.1-4+deb12u5_all.deb
81e8ac991af56b3d9f1477fea7f57117 416440 debug optional cyrus-imapd-dbgsym_3.6.1-4+deb12u5_amd64.deb
ed2db876e506df346c67afb66f5e53e3 17885 mail optional cyrus-imapd_3.6.1-4+deb12u5_amd64.buildinfo
22ffe858f7cb7c7bc4acd90e3323e3db 209988 mail optional cyrus-imapd_3.6.1-4+deb12u5_amd64.deb
0ed6127ca84989bc4f160fc071802243 64832 debug optional cyrus-murder-dbgsym_3.6.1-4+deb12u5_amd64.deb
730628d4b1bfb33257a0a8709d8fe248 74172 mail optional cyrus-murder_3.6.1-4+deb12u5_amd64.deb
a5e0d386959dd2f7b1dd340b007c2d63 247728 debug optional cyrus-nntpd-dbgsym_3.6.1-4+deb12u5_amd64.deb
799beca288ccacbcf3265f3f3b50c75f 142444 mail optional cyrus-nntpd_3.6.1-4+deb12u5_amd64.deb
4d50beee7e56986ed7befd6ad7f3c827 195376 debug optional cyrus-pop3d-dbgsym_3.6.1-4+deb12u5_amd64.deb
f23c43e3abc4500bcb6b247aebd00620 121700 mail optional cyrus-pop3d_3.6.1-4+deb12u5_amd64.deb
5b8884712406f1b7c94daef2bf5c3935 426756 debug optional cyrus-replication-dbgsym_3.6.1-4+deb12u5_amd64.deb
6289023dbeed656eedcd3546e208171c 143124 mail optional cyrus-replication_3.6.1-4+deb12u5_amd64.deb
e08ccb64c92ea3741d3b9d6438c93ca3 438760 debug optional libcyrus-imap-perl-dbgsym_3.6.1-4+deb12u5_amd64.deb
244018189fc31c39a9dd4c327a7c1690 272844 perl optional libcyrus-imap-perl_3.6.1-4+deb12u5_amd64.deb
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEAN/li4tVV3nRAF7J9tdMp8mZ7ukFAmqW8r0ACgkQ9tdMp8mZ
7ulkNxAAmivyTfFRQyAgfDLEgVjd9J0vg+DAJVrKxnKX3vf89UfZShjRcuwRLdGH
hI6PfJnGWodpGTfOaaPQuDUw1OmCEnu77T8CExplFGEtA1R8k1x61YH6AhQPEz58
uldfmTcponxOAt96WonwQGcKXDjXzgm52hQ6JPOsBQrrBdQ6UKaIno6/VN908nVt
kBCqRk/uZGWQjdtPcE8Ed3MYq4SZYU+zFh/0e6luVkiwuHTfJy5IixKndtzhxfG+
xFtha++e84gXwnbqgXTuB12FLoCWBSz/S8u7CgnEFDyEIgd+MYMYCQVXObS0qx3o
R3kozXKvnzBz6ix3fEW0ISdVGXnk53fji0lOc+VFVRoqIYxO6fG5DbG/oN/4Lfaq
PW+C1vtql6p5dtLKxeUlOwG/YzRRC6knv36A/oeNzluSW68b/okMIvhx/FDc4GsC
7yEvWCMGvzS/aTGrFRfy4rfQI+Mg0E0os7d+f8lvq1SWyO5mWKcZb8fV961gWf1x
BLqsC21UxpvaPunxI4rHtBA5TIlIyhN+3TseON998F+CTEiC7pW1vPJ7/IyU5Iei
9/k8WMvID6eF24F2PFzuLAsRGqhr2Lu24usyOTSdwQkOppm0qKDHtC2rIMEZ31St
luTaNCBY0Nq8Y1VqmetpmEjTBmu7XbwU2T4nxEkjCgnWRK1+F4c=
=d0KP
-----END PGP SIGNATURE-----
