-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Sun, 02 Aug 2026 12:00:00 +0200 Source: cyrus-imapd Binary: cyrus-admin cyrus-admin-dbgsym cyrus-caldav cyrus-caldav-dbgsym cyrus-clients cyrus-clients-dbgsym cyrus-common cyrus-common-dbgsym cyrus-dev cyrus-imapd cyrus-imapd-dbgsym cyrus-murder cyrus-murder-dbgsym cyrus-nntpd cyrus-nntpd-dbgsym cyrus-pop3d cyrus-pop3d-dbgsym cyrus-replication cyrus-replication-dbgsym libcyrus-imap-perl libcyrus-imap-perl-dbgsym Architecture: arm64 Version: 3.10.2-1+deb13u2 Distribution: trixie Urgency: medium Maintainer: arm64 Build Daemon (arm-conova-01) Changed-By: Edmund Lodewijks Description: cyrus-admin - Cyrus mail system - administration tools cyrus-caldav - Cyrus mail system - CalDAV and CardDAV support cyrus-clients - Cyrus mail system - test clients cyrus-common - Cyrus mail system - common files cyrus-dev - Cyrus mail system - developer files cyrus-imapd - Cyrus mail system - IMAP support cyrus-murder - Cyrus mail system - proxies and aggregator cyrus-nntpd - Cyrus mail system - NNTP support cyrus-pop3d - Cyrus mail system - POP3 support cyrus-replication - Cyrus mail system - replication libcyrus-imap-perl - Interface to Cyrus imap client imclient library Closes: 1142925 Changes: cyrus-imapd (3.10.2-1+deb13u2) trixie; urgency=medium . * Backport security fixes from upstream 3.10.3 (Closes: #1142925) (https://www.cyrusimap.org/imap/download/release-notes/3.10/x/3.10.3.html): - CVE-2026-47084: LOCALDELETE bypassed ACL checks, allowing non-admin users to delete mailboxes without permission. - CVE-2026-47086: GENURLAUTH issued URLAUTH tokens without checking ACL_READ on the target mailbox. - CVE-2026-47087: URLAUTH tokens kept working after the authorizer's access was revoked. - CVE-2026-47081: XAPPLEPUSHSERVICE allowed probing for mailbox existence and hijacking push notifications on other users' folders. - CVE-2026-47089: LISTRIGHTS was not restricted to users with admin access on the target mailbox. - CVE-2026-47085: URLAUTH tokens could be forged via a predictable empty mboxkey. - CVE-2026-47083: MULTISEARCH/ESEARCH allowed a cross-user folder and content enumeration oracle. - CVE-2026-47088: heap out-of-bounds read when parsing nested MIME comments in RFC 822 headers. - CVE-2026-47082: vacation "fcc" delivery skipped the ACL check on the destination mailbox. * This revision adds DEP-3 metadata to the new patches and restores upstream Cassandane regression tests that were missing from the initial debdiff (thanks, Codin!) for several of the fixes. Checksums-Sha1: e1a954d58218dc41a5f9364cceb9d79d21b906da 34580 cyrus-admin-dbgsym_3.10.2-1+deb13u2_arm64.deb c5b4aeab23ab26039b32173598a095a2818e9ff6 88544 cyrus-admin_3.10.2-1+deb13u2_arm64.deb 6481005702be9e2e909fee43025a8c0f6c44853a 1869904 cyrus-caldav-dbgsym_3.10.2-1+deb13u2_arm64.deb 1258c3a036a3774b47cce6d6a3a5614baecb4b30 619424 cyrus-caldav_3.10.2-1+deb13u2_arm64.deb 7f73be7c88a186d1edba26d9b84a6588a507a3e1 59508 cyrus-clients-dbgsym_3.10.2-1+deb13u2_arm64.deb 2a0e94800849fdb36c71e087fffd0e17085fa070 89772 cyrus-clients_3.10.2-1+deb13u2_arm64.deb 5bb9dd0b8622024362552cf4eeddc67c781aabcd 4464052 cyrus-common-dbgsym_3.10.2-1+deb13u2_arm64.deb 01a624cc14ebdea481e6a76eb2618423ff313159 1367436 cyrus-common_3.10.2-1+deb13u2_arm64.deb 3523ebbcd255c23e3a4bd9ef2935ea54702b8d72 80616 cyrus-dev_3.10.2-1+deb13u2_arm64.deb 59739c1670ca8931210946f5e30dd081802b2c52 438116 cyrus-imapd-dbgsym_3.10.2-1+deb13u2_arm64.deb 419123424e2716c3dc30294d2e21f4633e6a3ca8 17245 cyrus-imapd_3.10.2-1+deb13u2_arm64-buildd.buildinfo 8c4fdd0fc1a3f68b0a982ac82f985d72b3034c10 207480 cyrus-imapd_3.10.2-1+deb13u2_arm64.deb 6c28a1c5f28dfada902743706eff078d08842b3b 65288 cyrus-murder-dbgsym_3.10.2-1+deb13u2_arm64.deb 8c1bf669eba66e3c1344236200399b3bc6867b1a 76004 cyrus-murder_3.10.2-1+deb13u2_arm64.deb 8a9e7485fb6f743e278cb7a44f343611c1f55495 250400 cyrus-nntpd-dbgsym_3.10.2-1+deb13u2_arm64.deb e4e2cb0e19c5ff3b4f5f6c21ac6247facf993c6a 137572 cyrus-nntpd_3.10.2-1+deb13u2_arm64.deb 77bfab9c971baa42a08686780db1888a8b3ece90 202388 cyrus-pop3d-dbgsym_3.10.2-1+deb13u2_arm64.deb 54cc83630a8c07be7ac0c449469874f9e60af2fa 117336 cyrus-pop3d_3.10.2-1+deb13u2_arm64.deb 41ed229d48863cef9ea1435c61fbd452d66bb048 428876 cyrus-replication-dbgsym_3.10.2-1+deb13u2_arm64.deb 193054bc8d12b056704c36a97a5e82aa838e502b 141088 cyrus-replication_3.10.2-1+deb13u2_arm64.deb df0c553e198a9be71ab40a3455ede0ccd6d5b041 463468 libcyrus-imap-perl-dbgsym_3.10.2-1+deb13u2_arm64.deb 7ec0e3f3a8ff47778f4109d8ad242ffbb2f25547 267864 libcyrus-imap-perl_3.10.2-1+deb13u2_arm64.deb Checksums-Sha256: 4d746b64d911b1eb579a368d3736af0cff43a437dfd8581f10383e9671dad338 34580 cyrus-admin-dbgsym_3.10.2-1+deb13u2_arm64.deb 8076935df8e39757c36f1281dc93dd71c1fc3bb9f56f76a6f8fd7c2a679693e1 88544 cyrus-admin_3.10.2-1+deb13u2_arm64.deb eba94fd1df27765fd31b3bac986978399eeadc309e5b3f4ed37039a72e4338de 1869904 cyrus-caldav-dbgsym_3.10.2-1+deb13u2_arm64.deb 7d4e3a296f7685105a9fe9074821f06c9b433d82faa14b8b5468e4e1c4f87164 619424 cyrus-caldav_3.10.2-1+deb13u2_arm64.deb 855c82319e7d05408e0c9d51c1ba98ec939a271798bf5298bacbf601cfd30fcf 59508 cyrus-clients-dbgsym_3.10.2-1+deb13u2_arm64.deb cbb1bfeb8effc2b03dc2cce9a3513b279fa4b0156d1f89bb7e08ead0667a9378 89772 cyrus-clients_3.10.2-1+deb13u2_arm64.deb 5725a0402b619d863df45b98b082e017ffa9bb8c05a77d43c06d783a9d838573 4464052 cyrus-common-dbgsym_3.10.2-1+deb13u2_arm64.deb 878f5930628f0b580d8ff8eeb6e3887d17ddc677560487b78c83c20117390e70 1367436 cyrus-common_3.10.2-1+deb13u2_arm64.deb 41c578a4fa7a6461bef708c4118d68d6f0e1cd5f97a9a9e76e9e47dd5d9e6638 80616 cyrus-dev_3.10.2-1+deb13u2_arm64.deb ffc1c0b603bd705cbd26135057ff3b21dff1fd435958c6f133437efccaaf74b9 438116 cyrus-imapd-dbgsym_3.10.2-1+deb13u2_arm64.deb 625527d7f95afedf44a8dd22e5e2e723949eeda7824ebb8a729b7d29b4851f64 17245 cyrus-imapd_3.10.2-1+deb13u2_arm64-buildd.buildinfo cccffca6dbed6b88c27158187a65e6d2f183131cb11ff0d58ab3285369a7b15f 207480 cyrus-imapd_3.10.2-1+deb13u2_arm64.deb 70af16c049d9dab54aa1eb437cd9e4fdda338f9753ed416f96eba6ad4935ae75 65288 cyrus-murder-dbgsym_3.10.2-1+deb13u2_arm64.deb 4568ab7052f14f044a5401e7f83ebf9ebba2d39ce35675ee39d2a868309c2e98 76004 cyrus-murder_3.10.2-1+deb13u2_arm64.deb 8d8480450477001a05f4f8406c55ec94516f06d14ab24b372d4d49822a4642cb 250400 cyrus-nntpd-dbgsym_3.10.2-1+deb13u2_arm64.deb 1631125541cfda2071e0396e68935daaad3708c1a7336eb59253f310afbffdab 137572 cyrus-nntpd_3.10.2-1+deb13u2_arm64.deb 46c168275b33edbd47f66dd9c1bca9b3cce10ee79bb8dc89e2952f2b8c17504d 202388 cyrus-pop3d-dbgsym_3.10.2-1+deb13u2_arm64.deb 2bb3115823ef5682ab24a2816fd52d69615a40799024586a703b4c4701a78021 117336 cyrus-pop3d_3.10.2-1+deb13u2_arm64.deb bad1fe2db0e55b3bfe29b86c17e0e4663dfa3fe6005cd78c983e702127cebf43 428876 cyrus-replication-dbgsym_3.10.2-1+deb13u2_arm64.deb d2859225e32a4ec17ccae5348732ceba1ed6b13b7b1b3a73c8ea9382b4a98c03 141088 cyrus-replication_3.10.2-1+deb13u2_arm64.deb ad505a801195d01b2241ccec59fe44ddfb8b92c8d8d7492776678f7ff15c0ee6 463468 libcyrus-imap-perl-dbgsym_3.10.2-1+deb13u2_arm64.deb 7cc966a1212e6f7487dfbc6caf4833ace79303a371e2e044d77c8f17c81c2297 267864 libcyrus-imap-perl_3.10.2-1+deb13u2_arm64.deb Files: 66a7b87208f5a780804de5f7b1243b28 34580 debug optional cyrus-admin-dbgsym_3.10.2-1+deb13u2_arm64.deb 85c32d7cfc742db39be9e645246d02b2 88544 mail optional cyrus-admin_3.10.2-1+deb13u2_arm64.deb 839d43705e73a7e5017f8f7143cfeacf 1869904 debug optional cyrus-caldav-dbgsym_3.10.2-1+deb13u2_arm64.deb 73ced7da85322c79ffda9318fdc27eea 619424 mail optional cyrus-caldav_3.10.2-1+deb13u2_arm64.deb 33a658ff4f61193fdeda432741ac0d8a 59508 debug optional cyrus-clients-dbgsym_3.10.2-1+deb13u2_arm64.deb b24d5c0b6c116f64ffea18ad2c6b0b18 89772 mail optional cyrus-clients_3.10.2-1+deb13u2_arm64.deb b1d0a58019e5c41a6f221f889651e731 4464052 debug optional cyrus-common-dbgsym_3.10.2-1+deb13u2_arm64.deb 13df23be6376402fc9f31d10d14a6c21 1367436 mail optional cyrus-common_3.10.2-1+deb13u2_arm64.deb ae0d1a4742d9bab9492ea291ef734db8 80616 devel optional cyrus-dev_3.10.2-1+deb13u2_arm64.deb ff19f588cf1fe34e29a98db10a77617d 438116 debug optional cyrus-imapd-dbgsym_3.10.2-1+deb13u2_arm64.deb 95ffc949c709063b4c29a13d97950bde 17245 mail optional cyrus-imapd_3.10.2-1+deb13u2_arm64-buildd.buildinfo aa79fcba842b794a29ee2b10e58f3a3a 207480 mail optional cyrus-imapd_3.10.2-1+deb13u2_arm64.deb f67132f93ab934e9d45a47f79c66102c 65288 debug optional cyrus-murder-dbgsym_3.10.2-1+deb13u2_arm64.deb d5d2796cf08930bc2b2507e60e38ff17 76004 mail optional cyrus-murder_3.10.2-1+deb13u2_arm64.deb 2d238328ee72f5c078677c7d606f22ab 250400 debug optional cyrus-nntpd-dbgsym_3.10.2-1+deb13u2_arm64.deb b2bbab00fe997ca37bbfdeb27f5aaad0 137572 mail optional cyrus-nntpd_3.10.2-1+deb13u2_arm64.deb a5e93abf0501ff28ac43a0e8dfb0431d 202388 debug optional cyrus-pop3d-dbgsym_3.10.2-1+deb13u2_arm64.deb 8eba2e7f45f9ea583002e06bcf181b1b 117336 mail optional cyrus-pop3d_3.10.2-1+deb13u2_arm64.deb 704652a443e56a83b376daa92d018548 428876 debug optional cyrus-replication-dbgsym_3.10.2-1+deb13u2_arm64.deb 90bb3ff24891922dca19794ec3514bca 141088 mail optional cyrus-replication_3.10.2-1+deb13u2_arm64.deb 4ed23466f7489327ed5fec8a76e80bc8 463468 debug optional libcyrus-imap-perl-dbgsym_3.10.2-1+deb13u2_arm64.deb 6a69e1bb61683161003cf1e2ac9bc6ed 267864 perl optional libcyrus-imap-perl_3.10.2-1+deb13u2_arm64.deb -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEO4qAQUSIo2p/kVRf8U6eOZMpj68FAmqcOfgACgkQ8U6eOZMp j6+OBQ/8D76W47qAwhgcZJgSca9y3QSiIN/D2GQ03Jts86XMMTtM/r3RmMZPPYHH A/pMxavU1LWSYVqF9W74ygVD3U6hqRG0wy+hKlges/I2GB1Ygt7FwFBgV4aBoAJH BvSR3S+dG6tKV5lUHyCvpWCHNe0bs9tMgmT0zo47/8YGoHEI68QblmKYDfYzAvEj ycCuClg45tW0SaAyRpLvL2SGN4DjcSNr9FdrgkAoreVe1AXZhMByLvptSrJiRqbi wOeYKxkoo3GWLtqZOD3SxIyT09pypX59LktUeH3pAzMgpCMGs+zM80YnqSueTOe4 SHxoO4Ob9bYAMraQ0RLMaUQXLGjGdb7eTgX/LE1S1/k26WflHDt4LNYdHNFVV/2j QayiD4OOyxtlHBQpnYCvGEPOdrkhWS4EXicr9p/CaZPKgEK560paadBziAozRTJg JW0vK9d+M0P8y/Ne5gzuKQWGd/8aclucCj5FURplFRLODEBGx0HXFWuK7DidOHrM A7WjjptLXPDM3E2G4aOlh4nM8Jqra+WiyAED0IDTFHsh80vcpq3v1nNsgjPBqhYX qa2nVOJvQoBWmJtP1xiGePgV25w6MXyqjQjvQMFYMYTn8O7x/zDh5KkcJg4MN98H W7SfBP1uTn1IvRB8jBaNoPW5M89EN7qcwiDvLKpvYtM6gh+445g= =urqN -----END PGP SIGNATURE-----