-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Sun, 02 Aug 2026 12:00:00 +0200 Source: cyrus-imapd Architecture: source Version: 3.10.2-1+deb13u2 Distribution: trixie Urgency: medium Maintainer: Debian Cyrus Team <team+cyrus@tracker.debian.org> Changed-By: Edmund Lodewijks <edmund@proteamail.com> Closes: 1142925 Changes: cyrus-imapd (3.10.2-1+deb13u2) trixie; urgency=medium . * Backport security fixes from upstream 3.10.3 (Closes: #1142925) (https://www.cyrusimap.org/imap/download/release-notes/3.10/x/3.10.3.html): - CVE-2026-47084: LOCALDELETE bypassed ACL checks, allowing non-admin users to delete mailboxes without permission. - CVE-2026-47086: GENURLAUTH issued URLAUTH tokens without checking ACL_READ on the target mailbox. - CVE-2026-47087: URLAUTH tokens kept working after the authorizer's access was revoked. - CVE-2026-47081: XAPPLEPUSHSERVICE allowed probing for mailbox existence and hijacking push notifications on other users' folders. - CVE-2026-47089: LISTRIGHTS was not restricted to users with admin access on the target mailbox. - CVE-2026-47085: URLAUTH tokens could be forged via a predictable empty mboxkey. - CVE-2026-47083: MULTISEARCH/ESEARCH allowed a cross-user folder and content enumeration oracle. - CVE-2026-47088: heap out-of-bounds read when parsing nested MIME comments in RFC 822 headers. - CVE-2026-47082: vacation "fcc" delivery skipped the ACL check on the destination mailbox. * This revision adds DEP-3 metadata to the new patches and restores upstream Cassandane regression tests that were missing from the initial debdiff (thanks, Codin!) for several of the fixes. Checksums-Sha1: 9b29f38e162e342f38ea7d6661f2970dc1cc9c7e 5929 cyrus-imapd_3.10.2-1+deb13u2.dsc dbc6b67d0312a2167391f47846e23f17ff67395d 97480 cyrus-imapd_3.10.2-1+deb13u2.debian.tar.xz Checksums-Sha256: 945f3a727f5cd80e29b516e8348e187037c6e9f34f28b2a7627db78fa5cc9938 5929 cyrus-imapd_3.10.2-1+deb13u2.dsc b285bbd0fd42e0ff6d1895bbc42c949c13ea69484c4698110040024632613880 97480 cyrus-imapd_3.10.2-1+deb13u2.debian.tar.xz Files: f5a359cfe0ac159cb925f2287c510195 5929 mail optional cyrus-imapd_3.10.2-1+deb13u2.dsc 6335d306251e4db60d468ff099d41773 97480 mail optional cyrus-imapd_3.10.2-1+deb13u2.debian.tar.xz -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEAN/li4tVV3nRAF7J9tdMp8mZ7ukFAmqa0IYACgkQ9tdMp8mZ 7ukw9g/+K22V6xuhTaM/uCA6iNHtD+Jnp6iKtZnsJ0l4VlMcoSVufXGEgFkOPPTm bDk0QKF7K92b/TQ/YIJe38ueNGwwCAwUo529l7CX6c+m3pc5rrOk4LB/+HbE+ixb jwC2uiKuBQjSb2NvXB+h3PJFFtO/1QPUA4JWEABAGWbgK9LVHT+RRP0Xy905b515 FUYjusBqJFBtm+VxWrpHka3423Wv1+7cAO2UTq1vnHgP1nd/EzofR5rJWZ5Yfuhu 8k4eO9+seWftbAXHvdKNge3gU7pgtxC4yjfNaTgVUKoua8NQR7f5rCCXrRX8Fk2Q e5orDP1q6qJbxl5f8JgXtj66DXRZJxXPchgCWusEqT2H5YgZzTbTHyJ1iev0Uj2g RIKA2cSojimaNh3m0s2sZmUPsOukdgjeluDoF0vzyR0JN7LryvdgKMgtimAU1UQD g48Ci7D4PKx3FVzqTXMkHYmcNgOoBHtQPAG2vfrXC9VZAuF7s1Do0VZPxT7DjJJT Saz9y9d0xf2PBWapS5OYVzFETPS/OIspXoWGlJ7fykyI018wz3a54kEK1JHCRiUr XOh3r+ZFpAdFDE8W2anUvQfxZ8J5wnzJrR/sUcYpgU7OThgX3GplAI727VrCmK9a 5BFRGX+Lcqxt8EfI1JIHkgHQyUWLbMFGudkGqnkK9f860ejt3Os= =LzWW -----END PGP SIGNATURE-----
