-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Sun, 02 Aug 2026 12:00:00 +0200 Source: cyrus-imapd Binary: cyrus-admin cyrus-admin-dbgsym cyrus-caldav cyrus-caldav-dbgsym cyrus-clients cyrus-clients-dbgsym cyrus-common cyrus-common-dbgsym cyrus-dev cyrus-imapd cyrus-imapd-dbgsym cyrus-murder cyrus-murder-dbgsym cyrus-nntpd cyrus-nntpd-dbgsym cyrus-pop3d cyrus-pop3d-dbgsym cyrus-replication cyrus-replication-dbgsym libcyrus-imap-perl libcyrus-imap-perl-dbgsym Architecture: ppc64el Version: 3.10.2-1+deb13u2 Distribution: trixie Urgency: medium Maintainer: ppc64el Build Daemon (ppc64el-osuosl-02) Changed-By: Edmund Lodewijks Description: cyrus-admin - Cyrus mail system - administration tools cyrus-caldav - Cyrus mail system - CalDAV and CardDAV support cyrus-clients - Cyrus mail system - test clients cyrus-common - Cyrus mail system - common files cyrus-dev - Cyrus mail system - developer files cyrus-imapd - Cyrus mail system - IMAP support cyrus-murder - Cyrus mail system - proxies and aggregator cyrus-nntpd - Cyrus mail system - NNTP support cyrus-pop3d - Cyrus mail system - POP3 support cyrus-replication - Cyrus mail system - replication libcyrus-imap-perl - Interface to Cyrus imap client imclient library Closes: 1142925 Changes: cyrus-imapd (3.10.2-1+deb13u2) trixie; urgency=medium . * Backport security fixes from upstream 3.10.3 (Closes: #1142925) (https://www.cyrusimap.org/imap/download/release-notes/3.10/x/3.10.3.html): - CVE-2026-47084: LOCALDELETE bypassed ACL checks, allowing non-admin users to delete mailboxes without permission. - CVE-2026-47086: GENURLAUTH issued URLAUTH tokens without checking ACL_READ on the target mailbox. - CVE-2026-47087: URLAUTH tokens kept working after the authorizer's access was revoked. - CVE-2026-47081: XAPPLEPUSHSERVICE allowed probing for mailbox existence and hijacking push notifications on other users' folders. - CVE-2026-47089: LISTRIGHTS was not restricted to users with admin access on the target mailbox. - CVE-2026-47085: URLAUTH tokens could be forged via a predictable empty mboxkey. - CVE-2026-47083: MULTISEARCH/ESEARCH allowed a cross-user folder and content enumeration oracle. - CVE-2026-47088: heap out-of-bounds read when parsing nested MIME comments in RFC 822 headers. - CVE-2026-47082: vacation "fcc" delivery skipped the ACL check on the destination mailbox. * This revision adds DEP-3 metadata to the new patches and restores upstream Cassandane regression tests that were missing from the initial debdiff (thanks, Codin!) for several of the fixes. Checksums-Sha1: 58e8ea440fe98964ee82eb1d0c5fb9a35d18fec0 34916 cyrus-admin-dbgsym_3.10.2-1+deb13u2_ppc64el.deb 1a6a1ca3f76cd238ba90a8ab0409bd2c72b12830 89524 cyrus-admin_3.10.2-1+deb13u2_ppc64el.deb 4e7353d884ed8e46b353ecd05c04d1046e73525a 1964108 cyrus-caldav-dbgsym_3.10.2-1+deb13u2_ppc64el.deb 01c1b0f1ef71171e62a553bc827f860dccd4261a 746512 cyrus-caldav_3.10.2-1+deb13u2_ppc64el.deb 57b9f51369815fd417a8751f5c73358aa720adf3 61596 cyrus-clients-dbgsym_3.10.2-1+deb13u2_ppc64el.deb 4ec62b83c378f8b8f1c000b5e7df317e97694801 92620 cyrus-clients_3.10.2-1+deb13u2_ppc64el.deb 37b814449948010d5f0bc18b8493383f39b8b282 4328680 cyrus-common-dbgsym_3.10.2-1+deb13u2_ppc64el.deb d3b265da4bfdf6692ad6932237d4ca6460067e02 1562036 cyrus-common_3.10.2-1+deb13u2_ppc64el.deb f7d1a4b1451448a2bf4080afa14a9026cfc9c3a5 80624 cyrus-dev_3.10.2-1+deb13u2_ppc64el.deb f51426474b4d8e2e5d9a6b9409a42267388bf017 446824 cyrus-imapd-dbgsym_3.10.2-1+deb13u2_ppc64el.deb d52d31c11431382da01662e216a12f86c24576a2 17374 cyrus-imapd_3.10.2-1+deb13u2_ppc64el-buildd.buildinfo c3db984498b4a4f0fb251711cdb95e0481f566d9 240584 cyrus-imapd_3.10.2-1+deb13u2_ppc64el.deb 389bfd328c0b5649cfc40c80fd435a33addbe394 67836 cyrus-murder-dbgsym_3.10.2-1+deb13u2_ppc64el.deb c1753f4913a978989d283f782a75b5aa04f7142a 79484 cyrus-murder_3.10.2-1+deb13u2_ppc64el.deb 8bcdf31f35b1ba8e5e75c4a8ce314e9c3bb3e7ef 257268 cyrus-nntpd-dbgsym_3.10.2-1+deb13u2_ppc64el.deb 90eb9f44550993db1c218f792a48b5f9cd3c1239 154800 cyrus-nntpd_3.10.2-1+deb13u2_ppc64el.deb 53af5f7bd113a16816bafd60715418bd79b0d894 213392 cyrus-pop3d-dbgsym_3.10.2-1+deb13u2_ppc64el.deb e858fea81a31b4e0446bfb68ccfd36d30565a604 132112 cyrus-pop3d_3.10.2-1+deb13u2_ppc64el.deb 4ba8a1a4be9b57fa1d40720bffd2479fbf793d18 407028 cyrus-replication-dbgsym_3.10.2-1+deb13u2_ppc64el.deb e7e6b74553c01f1a4205a3ffc6515ed974a5f5d9 155880 cyrus-replication_3.10.2-1+deb13u2_ppc64el.deb 17628f15b0dabbc283a88364e7b72bc58b5ef28c 470380 libcyrus-imap-perl-dbgsym_3.10.2-1+deb13u2_ppc64el.deb c69de20dbbea7d7145676c377b13d4696e532104 288316 libcyrus-imap-perl_3.10.2-1+deb13u2_ppc64el.deb Checksums-Sha256: ceff83a68ad6ca9550c91aaac5d166d85431ddeda34f57b4efa8290db6b2d640 34916 cyrus-admin-dbgsym_3.10.2-1+deb13u2_ppc64el.deb 61c71126ac264943c9fb9a4fa65066d2ca1c1a777b88da9c5bc1b61426c12092 89524 cyrus-admin_3.10.2-1+deb13u2_ppc64el.deb 27410f18f1dc268f380d3012b7ec5d2916c63d85278bca7d5902206586e0a194 1964108 cyrus-caldav-dbgsym_3.10.2-1+deb13u2_ppc64el.deb c76bc192e89be91cf819243c1ef9262163134fd3bcc7b0c4a601c07ec5437050 746512 cyrus-caldav_3.10.2-1+deb13u2_ppc64el.deb c4f31cb12ceb72383cd46988f5a139c2736e3db0a1e5353c69c098385b884e80 61596 cyrus-clients-dbgsym_3.10.2-1+deb13u2_ppc64el.deb bca5b2ef667bc9bc931c3f8736b25629d8037ba98f36bfada725150e7ea75d98 92620 cyrus-clients_3.10.2-1+deb13u2_ppc64el.deb d7170486595c69e585cbd3e64d7d8eb92720424aa21168acc9d61f2320eb6cf6 4328680 cyrus-common-dbgsym_3.10.2-1+deb13u2_ppc64el.deb eb6d165586a8d430c16eab3d06dd529a8ea353ec2b3b390ee4099354a5e435e2 1562036 cyrus-common_3.10.2-1+deb13u2_ppc64el.deb b142763d764c79a4c5f381d66aec0e9feabff320b44a5ecd2c85696b0efcea11 80624 cyrus-dev_3.10.2-1+deb13u2_ppc64el.deb a47a101632e6e8bd57b037154baf6c31369a127d52fc51c1a5778abe90e1aed4 446824 cyrus-imapd-dbgsym_3.10.2-1+deb13u2_ppc64el.deb 7167a6f1e6e06c1afaec66b9e141db18da3351ff2423f904c9d06c5b2ff62733 17374 cyrus-imapd_3.10.2-1+deb13u2_ppc64el-buildd.buildinfo 575f1c586157e927efc5966183a65d670eccb6e749aa127789a0851994df25ce 240584 cyrus-imapd_3.10.2-1+deb13u2_ppc64el.deb ae47b018c6e560ee30216cf1ca29a712e0534b3f1a9941bcddcf6ec7da951692 67836 cyrus-murder-dbgsym_3.10.2-1+deb13u2_ppc64el.deb fcfa16c6078d8d3a381e97eca129907c742083d1f6623c0821a52f5d740a74eb 79484 cyrus-murder_3.10.2-1+deb13u2_ppc64el.deb 9e4fadc5600bc245c45c412f6985be828b2cdf1e82e61eef1a1aabd909578ee4 257268 cyrus-nntpd-dbgsym_3.10.2-1+deb13u2_ppc64el.deb 97bd657338bc083c7583566e8fe2d54d0fc16789102e7184c7c58390e92c5a08 154800 cyrus-nntpd_3.10.2-1+deb13u2_ppc64el.deb ca8bca3bd96677695dd52ff6838dc53b3e05f73738bb835a4237d584f4f2ea82 213392 cyrus-pop3d-dbgsym_3.10.2-1+deb13u2_ppc64el.deb 0136d7c9643ec329b1e8c3d00f16cd4dc517efcd3446ca5521b376cb5471d544 132112 cyrus-pop3d_3.10.2-1+deb13u2_ppc64el.deb 4991cd91c0c09976ae805cf5feb9c480d7f9a64c030b08f1519289d4c8e0667a 407028 cyrus-replication-dbgsym_3.10.2-1+deb13u2_ppc64el.deb 88d1bbf3ab3461e90f1b9e9fb6c118f8bfe9ab7d9ad3919015b7b1704536bbcd 155880 cyrus-replication_3.10.2-1+deb13u2_ppc64el.deb ae55057e09118a6046406e0f55c952050c571930b6cfdb233be1541cd24444b7 470380 libcyrus-imap-perl-dbgsym_3.10.2-1+deb13u2_ppc64el.deb a5d49d07499cd81dc75253c1e528d6051a8eaf0b39366ad079793717c5946dd4 288316 libcyrus-imap-perl_3.10.2-1+deb13u2_ppc64el.deb Files: d2800bee63de3bfe4fcdb7a37df3587a 34916 debug optional cyrus-admin-dbgsym_3.10.2-1+deb13u2_ppc64el.deb 1c5c878276d5d2e3973139d59479b6b8 89524 mail optional cyrus-admin_3.10.2-1+deb13u2_ppc64el.deb 793e5aaea0fb5d12c97adbff7f21b982 1964108 debug optional cyrus-caldav-dbgsym_3.10.2-1+deb13u2_ppc64el.deb 2cf55f1a2c9357fdae4d702c002215ca 746512 mail optional cyrus-caldav_3.10.2-1+deb13u2_ppc64el.deb 17355d2f3bef7a50bc0fa85ce8873f1c 61596 debug optional cyrus-clients-dbgsym_3.10.2-1+deb13u2_ppc64el.deb 8ae8357bc2522805143214360a45980c 92620 mail optional cyrus-clients_3.10.2-1+deb13u2_ppc64el.deb 25ecc00b19bcfb4e6cb10357254dfa20 4328680 debug optional cyrus-common-dbgsym_3.10.2-1+deb13u2_ppc64el.deb 08e14ad2899ae87f237c6d1ebb490a37 1562036 mail optional cyrus-common_3.10.2-1+deb13u2_ppc64el.deb da164e45185883e34dcd1dfa568b4b70 80624 devel optional cyrus-dev_3.10.2-1+deb13u2_ppc64el.deb 393f08b51bbe4b1b18ed29eeabb797a2 446824 debug optional cyrus-imapd-dbgsym_3.10.2-1+deb13u2_ppc64el.deb d8bda057ec04527e50ad94e38675530b 17374 mail optional cyrus-imapd_3.10.2-1+deb13u2_ppc64el-buildd.buildinfo f0e692720cec2b2208505b165de38f2d 240584 mail optional cyrus-imapd_3.10.2-1+deb13u2_ppc64el.deb 5ed4814a59e50f535174fbbbc4d422dc 67836 debug optional cyrus-murder-dbgsym_3.10.2-1+deb13u2_ppc64el.deb 93927d3c5eae544b82e71bfbb2a7b084 79484 mail optional cyrus-murder_3.10.2-1+deb13u2_ppc64el.deb 0cd8efbee7054dffed554cd5c6ae25d7 257268 debug optional cyrus-nntpd-dbgsym_3.10.2-1+deb13u2_ppc64el.deb 780dc64110f62087b781bab4664127dd 154800 mail optional cyrus-nntpd_3.10.2-1+deb13u2_ppc64el.deb 64fdfa8be3399743b26c75ced8e8939e 213392 debug optional cyrus-pop3d-dbgsym_3.10.2-1+deb13u2_ppc64el.deb 40a28b959619ed43b829c25435aec0d1 132112 mail optional cyrus-pop3d_3.10.2-1+deb13u2_ppc64el.deb 54083cea4437a5a5701d6fdf78981f34 407028 debug optional cyrus-replication-dbgsym_3.10.2-1+deb13u2_ppc64el.deb b05d7305a67f14c117282ce1414f4103 155880 mail optional cyrus-replication_3.10.2-1+deb13u2_ppc64el.deb 69178150456b25c2c8cfbd9b7f31188a 470380 debug optional libcyrus-imap-perl-dbgsym_3.10.2-1+deb13u2_ppc64el.deb 5fa3728f4a2b2f58d0f51b76b0e8a303 288316 perl optional libcyrus-imap-perl_3.10.2-1+deb13u2_ppc64el.deb -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEE9ibmwdV9gdKNbK7oV8ucRsMTpuMFAmqcXdYACgkQV8ucRsMT puMA6Q/9HrG9AJT+7F/Cyo+yrXMeXkkUdThiUSIYUsfQR3gHwGKZiCEXL70bGrbT Pcz7A3nT02ya0VJccD9lHJdvlHM7XRqeBhtEqAy78nOClg5q+qrs7FcXdcOb7GOg PPgiZ2DdFjtB6Q5aHvfKnJiyDUnVY9WC2jxJSfLvKT+lQ7FiByft3V1w0xgYBU5H gveAaZGtb7qCUgTeDFeHHwsdkfqPRjqCqf2bIDXjef1cavIUJktCbFt7EAtD7l97 F9CFlfeNQPs120qHaHrGDLkg6bqmLkoINZ7mydAAlmtCP61ZzEyzC6ELhcX+oGf5 SZGdRkJge+CNl6HbpvB87G3RqaBbcciXvKrjQCpkbP81sd/AznY7nngPcmzooWzo QvnY+Tyc593fJfPBJascbQCmGcx5N31RKN+zVLJ5LfH03mHYFAFcGMmmAPfU4YE+ 4YEmbktE7NGtljoNiGNZ7WHbBaV+1YPyyJuujKU60Nz4m7piAhQyo74b48vWoYWj RA/GCRIpDbWbdmE1XybelwHhTahQSOykuhG2XQfg/xFe81TeIe8pgNDjLCd3aj8n zklsQ5vypjqon3CuRYAzwa/TnfFErfTve/1V0NMTmo2WgjOF2/xeqxgVrJFmGH79 csNyc19BDmMkz430kBgVJt+uSMd/3oVVZ4Au0K/UU7s2VvVC1sI= =anKA -----END PGP SIGNATURE-----