-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Sun, 02 Aug 2026 12:00:00 +0200 Source: cyrus-imapd Binary: cyrus-admin cyrus-admin-dbgsym cyrus-caldav cyrus-caldav-dbgsym cyrus-clients cyrus-clients-dbgsym cyrus-common cyrus-common-dbgsym cyrus-dev cyrus-imapd cyrus-imapd-dbgsym cyrus-murder cyrus-murder-dbgsym cyrus-nntpd cyrus-nntpd-dbgsym cyrus-pop3d cyrus-pop3d-dbgsym cyrus-replication cyrus-replication-dbgsym libcyrus-imap-perl libcyrus-imap-perl-dbgsym Architecture: amd64 Version: 3.10.2-1+deb13u2 Distribution: trixie Urgency: medium Maintainer: amd64 / i386 Build Daemon (x86-csail-01) Changed-By: Edmund Lodewijks Description: cyrus-admin - Cyrus mail system - administration tools cyrus-caldav - Cyrus mail system - CalDAV and CardDAV support cyrus-clients - Cyrus mail system - test clients cyrus-common - Cyrus mail system - common files cyrus-dev - Cyrus mail system - developer files cyrus-imapd - Cyrus mail system - IMAP support cyrus-murder - Cyrus mail system - proxies and aggregator cyrus-nntpd - Cyrus mail system - NNTP support cyrus-pop3d - Cyrus mail system - POP3 support cyrus-replication - Cyrus mail system - replication libcyrus-imap-perl - Interface to Cyrus imap client imclient library Closes: 1142925 Changes: cyrus-imapd (3.10.2-1+deb13u2) trixie; urgency=medium . * Backport security fixes from upstream 3.10.3 (Closes: #1142925) (https://www.cyrusimap.org/imap/download/release-notes/3.10/x/3.10.3.html): - CVE-2026-47084: LOCALDELETE bypassed ACL checks, allowing non-admin users to delete mailboxes without permission. - CVE-2026-47086: GENURLAUTH issued URLAUTH tokens without checking ACL_READ on the target mailbox. - CVE-2026-47087: URLAUTH tokens kept working after the authorizer's access was revoked. - CVE-2026-47081: XAPPLEPUSHSERVICE allowed probing for mailbox existence and hijacking push notifications on other users' folders. - CVE-2026-47089: LISTRIGHTS was not restricted to users with admin access on the target mailbox. - CVE-2026-47085: URLAUTH tokens could be forged via a predictable empty mboxkey. - CVE-2026-47083: MULTISEARCH/ESEARCH allowed a cross-user folder and content enumeration oracle. - CVE-2026-47088: heap out-of-bounds read when parsing nested MIME comments in RFC 822 headers. - CVE-2026-47082: vacation "fcc" delivery skipped the ACL check on the destination mailbox. * This revision adds DEP-3 metadata to the new patches and restores upstream Cassandane regression tests that were missing from the initial debdiff (thanks, Codin!) for several of the fixes. Checksums-Sha1: 44d6c78fccf727d84ca03640456fd61662b10ffc 34476 cyrus-admin-dbgsym_3.10.2-1+deb13u2_amd64.deb e315dba63e3b46d928001fe8405beb6b99f79600 88784 cyrus-admin_3.10.2-1+deb13u2_amd64.deb cb0c7161961c449c873c8e259aab713bbd72f2db 1891512 cyrus-caldav-dbgsym_3.10.2-1+deb13u2_amd64.deb d8306c53ffd487683c1ca092b7c2bb362b1b9d64 683080 cyrus-caldav_3.10.2-1+deb13u2_amd64.deb 953bcaf98a4e15718bc37ea57e0bd0f9e6d6f67a 59988 cyrus-clients-dbgsym_3.10.2-1+deb13u2_amd64.deb 2ad109d62b1b35dac0e10447b9f156a6caab8169 91136 cyrus-clients_3.10.2-1+deb13u2_amd64.deb 0d5ad559b8f9f6939c4c12f221fdf641539f9280 4540076 cyrus-common-dbgsym_3.10.2-1+deb13u2_amd64.deb 5ddc886ab450f08473f1c961c9cfcc422d3dbe77 1477892 cyrus-common_3.10.2-1+deb13u2_amd64.deb 98d76fdcc3c3327d3b5a7c8774d37abb1f908a7d 80624 cyrus-dev_3.10.2-1+deb13u2_amd64.deb e3d569ebf607a9dd4cce80339ef6f120d55887af 443564 cyrus-imapd-dbgsym_3.10.2-1+deb13u2_amd64.deb 4f22941aafe65c40bce64aea1472ca0b643e578c 17261 cyrus-imapd_3.10.2-1+deb13u2_amd64-buildd.buildinfo 78a8681b3e047af6ec7656e806384b988f77de78 224384 cyrus-imapd_3.10.2-1+deb13u2_amd64.deb f8cc3dd998c923f022089dd90236f0eb0e6250ff 65708 cyrus-murder-dbgsym_3.10.2-1+deb13u2_amd64.deb 44d94166a69ad92ec2837dfde5a9402301b5336a 77232 cyrus-murder_3.10.2-1+deb13u2_amd64.deb 8811620b99bcfdb41592a7e67d0e3e9934c59784 251768 cyrus-nntpd-dbgsym_3.10.2-1+deb13u2_amd64.deb a3e316fdc65ac549a88a1ed5b9631380175a26c2 144936 cyrus-nntpd_3.10.2-1+deb13u2_amd64.deb 6c3fc540a595aad9d8ebdf96b1c535ab279185c2 203844 cyrus-pop3d-dbgsym_3.10.2-1+deb13u2_amd64.deb 7ed77b1b6d0a4c681d7ad4ca4b5295cd5c7af1fa 124420 cyrus-pop3d_3.10.2-1+deb13u2_amd64.deb 104bd800aa36394e1c6d453d1823d292d378e981 429956 cyrus-replication-dbgsym_3.10.2-1+deb13u2_amd64.deb add34867bba74d369cfea43fd5b959cceb38b8a7 147796 cyrus-replication_3.10.2-1+deb13u2_amd64.deb 02cfcdb6c3f83de58c50d9ddae27b0ed4b453a6e 470168 libcyrus-imap-perl-dbgsym_3.10.2-1+deb13u2_amd64.deb 850e027fad0dd3be41198fe975577b6e9d864304 279184 libcyrus-imap-perl_3.10.2-1+deb13u2_amd64.deb Checksums-Sha256: 8d630d11887107eb52781a41de795205ee80adf000a8a84952544f4de71ad8af 34476 cyrus-admin-dbgsym_3.10.2-1+deb13u2_amd64.deb 012cc9cc6922f2e53b1452ede429283305009411d99e21ab6697af777d2f88cc 88784 cyrus-admin_3.10.2-1+deb13u2_amd64.deb b8468fbb2e795826dc7381347ac7ec93793ac26f8b1054613b0ba987426cdec4 1891512 cyrus-caldav-dbgsym_3.10.2-1+deb13u2_amd64.deb e4198e5b1059b7809a086d539abf13cefc97015dd63526d91818d8aeb357b917 683080 cyrus-caldav_3.10.2-1+deb13u2_amd64.deb ee7b46023df2944d25b045cf8df0e50766e5083e169d50c37adac72dc1dee192 59988 cyrus-clients-dbgsym_3.10.2-1+deb13u2_amd64.deb 0ae2304bb3b2e408183134868ea4ce3b0f9f5901e8955b1f0a9ae9f5b44be005 91136 cyrus-clients_3.10.2-1+deb13u2_amd64.deb e5450fc81ff000c1b1ea54bef13438549e7f30777d2181a094a808f5fbf0a01d 4540076 cyrus-common-dbgsym_3.10.2-1+deb13u2_amd64.deb f9a9783d00b30b6b188972b223530b73b65f320c76ccfea691a809e900f667b5 1477892 cyrus-common_3.10.2-1+deb13u2_amd64.deb 194e3f9d63e34102e2a98480c220a9224069326744ced7b268b1bc86867f5795 80624 cyrus-dev_3.10.2-1+deb13u2_amd64.deb c033dc5856ef13230a90f64cef1287f7e0ffdcde7732236d79b1c621dba2e5c1 443564 cyrus-imapd-dbgsym_3.10.2-1+deb13u2_amd64.deb 5fbeb5ce7cce90fec508262fe5251e79081a04a7e98cf67516e358a9cb6f2dec 17261 cyrus-imapd_3.10.2-1+deb13u2_amd64-buildd.buildinfo d6efc986f0cf7ab3ced7ddb1cb346a12f066e89b14fb0439259440aa2f1b22f7 224384 cyrus-imapd_3.10.2-1+deb13u2_amd64.deb 054bbdb4fe0527cfa0940ad20fc7b604e14e7ac70d0ada9a2f388fa135cd3da5 65708 cyrus-murder-dbgsym_3.10.2-1+deb13u2_amd64.deb 1ad8bf6483f9837e1dea007c03bb7271fee18766f6e9d6974cd4bb6a60d96c35 77232 cyrus-murder_3.10.2-1+deb13u2_amd64.deb 25e742c6338f8ef7a9d6b34ea802499d7c62e3ace893d8baf96aac07f1a33f02 251768 cyrus-nntpd-dbgsym_3.10.2-1+deb13u2_amd64.deb 7593cf914f18498c16332eeba2be9396a9a0f908b97840ff4d092f01bf994cc1 144936 cyrus-nntpd_3.10.2-1+deb13u2_amd64.deb 160c29bc28c5c86f81c4975305429736a850d403939b4e0f7a7d27f399d13240 203844 cyrus-pop3d-dbgsym_3.10.2-1+deb13u2_amd64.deb 3b5a97a90a37377a9086ca46258491e84b1fbeb6dad32a15147d2d3142c96985 124420 cyrus-pop3d_3.10.2-1+deb13u2_amd64.deb aa9928c27d2ee65bc1843792f691573f457f8068a5b2b62a831fb3f1ba243faf 429956 cyrus-replication-dbgsym_3.10.2-1+deb13u2_amd64.deb 19e1e72bd0ce17f7bd5a21dda2c3444f7ac4510b2975d39fa2d896271c4af026 147796 cyrus-replication_3.10.2-1+deb13u2_amd64.deb ff6bb0440a4ba70a8f1bba551d7ae44c3236b1370cc6a4947e46ba17aff50c54 470168 libcyrus-imap-perl-dbgsym_3.10.2-1+deb13u2_amd64.deb 442e4824c52ec06f0cd4c03ed6bd850ea57a475d0b8d56ea2f731ab7e2c0e744 279184 libcyrus-imap-perl_3.10.2-1+deb13u2_amd64.deb Files: b4f9743fdc7c9f8cffe6f59f668cb4fe 34476 debug optional cyrus-admin-dbgsym_3.10.2-1+deb13u2_amd64.deb fa100b6958a4020329f75d250624a605 88784 mail optional cyrus-admin_3.10.2-1+deb13u2_amd64.deb 504cc6dc9d68fbf6904644a9f4be6440 1891512 debug optional cyrus-caldav-dbgsym_3.10.2-1+deb13u2_amd64.deb f357fc55394a6c02375251431149bccb 683080 mail optional cyrus-caldav_3.10.2-1+deb13u2_amd64.deb a5e487f87239b5ef67e38b94ded3d1ed 59988 debug optional cyrus-clients-dbgsym_3.10.2-1+deb13u2_amd64.deb c8b7a5775a1747218f5a50acc27cc04d 91136 mail optional cyrus-clients_3.10.2-1+deb13u2_amd64.deb 336438a8f8e4e12e72cd0d9a3381db36 4540076 debug optional cyrus-common-dbgsym_3.10.2-1+deb13u2_amd64.deb d042312381142c49a05d293262e84dc0 1477892 mail optional cyrus-common_3.10.2-1+deb13u2_amd64.deb 21654bf21e21b7f72e1c9855cf2670b1 80624 devel optional cyrus-dev_3.10.2-1+deb13u2_amd64.deb ccc7e85432ccdd93bb6a4ef5bf5bcab8 443564 debug optional cyrus-imapd-dbgsym_3.10.2-1+deb13u2_amd64.deb 20270b50bc033a3c0aa5e3623711eb77 17261 mail optional cyrus-imapd_3.10.2-1+deb13u2_amd64-buildd.buildinfo 8299345ddf18b9c3b6553a9eca5e7e08 224384 mail optional cyrus-imapd_3.10.2-1+deb13u2_amd64.deb 7b37454d051dd086555831df85aee5d6 65708 debug optional cyrus-murder-dbgsym_3.10.2-1+deb13u2_amd64.deb 097aac253db10d52c05d57da6cccb410 77232 mail optional cyrus-murder_3.10.2-1+deb13u2_amd64.deb 2fee50603b04d3b74685da2f57f84c70 251768 debug optional cyrus-nntpd-dbgsym_3.10.2-1+deb13u2_amd64.deb b2d5296a5480181479d7cece7f1531f0 144936 mail optional cyrus-nntpd_3.10.2-1+deb13u2_amd64.deb dfdb8551ee713d6e4b2af3cdd88f70ae 203844 debug optional cyrus-pop3d-dbgsym_3.10.2-1+deb13u2_amd64.deb 31eb39d16688067a885959d9e6c31059 124420 mail optional cyrus-pop3d_3.10.2-1+deb13u2_amd64.deb 72317d3d8931b6699a7180d175e9a87f 429956 debug optional cyrus-replication-dbgsym_3.10.2-1+deb13u2_amd64.deb d586f67c30783940e21d180bbe9ab169 147796 mail optional cyrus-replication_3.10.2-1+deb13u2_amd64.deb 45d61b7a4d017b959f5e416035ac8342 470168 debug optional libcyrus-imap-perl-dbgsym_3.10.2-1+deb13u2_amd64.deb 3dee88b08e3570818b73120fdc7dba16 279184 perl optional libcyrus-imap-perl_3.10.2-1+deb13u2_amd64.deb -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEBDWXQb2umOtH4DRpYg9P9sm2dfEFAmqcXrMACgkQYg9P9sm2 dfGSehAA2c3owV+NXuLJ4vgFG5HadZdJn+oOOwvCUgzCxlzhHr3+OcjJPfdqlBaK 6xzDaQEfVEba0NddYdKhAn5cFWmHVLq0WCv7or42IOyvDey/l/1z/b5o+W8k1n00 SB/IBJtNmiUBcrKkTk+mboRkO1VRHByOB0aVJyjcPHg+4USshDumYFE8BE6yNSbp aBtbDx08U9I5VR6hlitZMKv41NpWfjy75THED6refN8Ncsmravs9IxQUkH+V/Npm RC7QG/XYAdfiEjWTTIrgVG6y3Vx8KVpsbHzeaBrKduzVVBZK1Tmap4ASnc7LH+GK gb8/2HjjhEu6tKS/fXQI2stu6Mezejrbtw6CDKHOAcgWIoEYBv6eoSXrx6eH5MCg l0RaMgmnaQfelzwqAkGGHogJIcE5UXZBSEEU5p2W95NGIAoLg0ACaUir/+pnW51I YZhDKWMmcxQ9hv3cMxCdMm+esWSns0KZzKllFV+SGLG+KXMbmfCSafRAA7XzIyJY sDFS0eVf8Dhto6YGBqNNfqixCOyyKgQ/hWYlVnDuu8wU6dfb+PY/huOVwflJAhUu nSxttqCfNwE62gglPW3Wsb0Xhdonon/dhDok8unjY9zwLNlVo7ix8C0/6By2MpYb hHKoojTXdJgwYwyBlOA3TUr2g6hrDI6iOceuiqDiCMEWiNvRYXM= =9PFn -----END PGP SIGNATURE-----