-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Sun, 02 Aug 2026 12:00:00 +0200 Source: cyrus-imapd Binary: cyrus-admin cyrus-admin-dbgsym cyrus-caldav cyrus-caldav-dbgsym cyrus-clients cyrus-clients-dbgsym cyrus-common cyrus-common-dbgsym cyrus-dev cyrus-imapd cyrus-imapd-dbgsym cyrus-murder cyrus-murder-dbgsym cyrus-nntpd cyrus-nntpd-dbgsym cyrus-pop3d cyrus-pop3d-dbgsym cyrus-replication cyrus-replication-dbgsym libcyrus-imap-perl libcyrus-imap-perl-dbgsym Architecture: riscv64 Version: 3.10.2-1+deb13u2 Distribution: trixie Urgency: medium Maintainer: riscv64 Build Daemon (rv-osuosl-01) Changed-By: Edmund Lodewijks Description: cyrus-admin - Cyrus mail system - administration tools cyrus-caldav - Cyrus mail system - CalDAV and CardDAV support cyrus-clients - Cyrus mail system - test clients cyrus-common - Cyrus mail system - common files cyrus-dev - Cyrus mail system - developer files cyrus-imapd - Cyrus mail system - IMAP support cyrus-murder - Cyrus mail system - proxies and aggregator cyrus-nntpd - Cyrus mail system - NNTP support cyrus-pop3d - Cyrus mail system - POP3 support cyrus-replication - Cyrus mail system - replication libcyrus-imap-perl - Interface to Cyrus imap client imclient library Closes: 1142925 Changes: cyrus-imapd (3.10.2-1+deb13u2) trixie; urgency=medium . * Backport security fixes from upstream 3.10.3 (Closes: #1142925) (https://www.cyrusimap.org/imap/download/release-notes/3.10/x/3.10.3.html): - CVE-2026-47084: LOCALDELETE bypassed ACL checks, allowing non-admin users to delete mailboxes without permission. - CVE-2026-47086: GENURLAUTH issued URLAUTH tokens without checking ACL_READ on the target mailbox. - CVE-2026-47087: URLAUTH tokens kept working after the authorizer's access was revoked. - CVE-2026-47081: XAPPLEPUSHSERVICE allowed probing for mailbox existence and hijacking push notifications on other users' folders. - CVE-2026-47089: LISTRIGHTS was not restricted to users with admin access on the target mailbox. - CVE-2026-47085: URLAUTH tokens could be forged via a predictable empty mboxkey. - CVE-2026-47083: MULTISEARCH/ESEARCH allowed a cross-user folder and content enumeration oracle. - CVE-2026-47088: heap out-of-bounds read when parsing nested MIME comments in RFC 822 headers. - CVE-2026-47082: vacation "fcc" delivery skipped the ACL check on the destination mailbox. * This revision adds DEP-3 metadata to the new patches and restores upstream Cassandane regression tests that were missing from the initial debdiff (thanks, Codin!) for several of the fixes. Checksums-Sha1: 1f32e9757bdabed5977c92533edda404aeb550a3 33560 cyrus-admin-dbgsym_3.10.2-1+deb13u2_riscv64.deb a0a043a5a409a35327af85525906f65ad6b49c5a 88252 cyrus-admin_3.10.2-1+deb13u2_riscv64.deb 278998259136089f4447fedac090da696892009f 1818644 cyrus-caldav-dbgsym_3.10.2-1+deb13u2_riscv64.deb 39c333678e8c8cb14c78dbafb64c9d5e6e37e9e5 669048 cyrus-caldav_3.10.2-1+deb13u2_riscv64.deb 26b69983a5d30e916b1a1f201eee17ac4a416bae 57152 cyrus-clients-dbgsym_3.10.2-1+deb13u2_riscv64.deb 8ea876ef71735eb28a3aa351e96b88ec4cdc4932 89640 cyrus-clients_3.10.2-1+deb13u2_riscv64.deb 903f5900870ed848c96ed0b0b386f8b5ebbcb26f 4200760 cyrus-common-dbgsym_3.10.2-1+deb13u2_riscv64.deb 0e6c8792a6fd4f5a1232a3d6b2a6a9cc3f1f0ee3 1449392 cyrus-common_3.10.2-1+deb13u2_riscv64.deb 4b7f4512ec66d6f71d16d152fd5dca011c51ada7 80616 cyrus-dev_3.10.2-1+deb13u2_riscv64.deb 8fc8cd2144f4cc0cfcfc67b74167386f71dd8e50 428844 cyrus-imapd-dbgsym_3.10.2-1+deb13u2_riscv64.deb f5b0bc6340c11b039ef4752c7d392fc84c0b2613 17319 cyrus-imapd_3.10.2-1+deb13u2_riscv64-buildd.buildinfo e99c8a6e9ad3e44a97b45dd2bd0091529863bd9b 219464 cyrus-imapd_3.10.2-1+deb13u2_riscv64.deb 6bf56133210818c26830b48ac4eeef0a042a46d0 64300 cyrus-murder-dbgsym_3.10.2-1+deb13u2_riscv64.deb d3eeae0f16cd9b07345cea0d0a0e49af02e2185b 76848 cyrus-murder_3.10.2-1+deb13u2_riscv64.deb 6bad5e1804fd6a2743e95d2376bb638aaae3ad1c 244600 cyrus-nntpd-dbgsym_3.10.2-1+deb13u2_riscv64.deb 7f87c13036b28a83c1a46cd4e9786de86a06eca5 142792 cyrus-nntpd_3.10.2-1+deb13u2_riscv64.deb bf6b4ab7f157bdcac8f4dd0505f465371277fc6e 198032 cyrus-pop3d-dbgsym_3.10.2-1+deb13u2_riscv64.deb 809417c4bc48f263a3965e746c6437eed92c322b 121228 cyrus-pop3d_3.10.2-1+deb13u2_riscv64.deb f024fae78142c83e7308c30ebfd8ecab198e32f6 416388 cyrus-replication-dbgsym_3.10.2-1+deb13u2_riscv64.deb 55d4e360a301496c08317cfe13f4ab20b29294dd 144812 cyrus-replication_3.10.2-1+deb13u2_riscv64.deb 483283fc27b0da261c4460d961a6c7c42ea5725c 450476 libcyrus-imap-perl-dbgsym_3.10.2-1+deb13u2_riscv64.deb caef2ce6d09fa28cf19c3697e3d338feecf89f6b 274160 libcyrus-imap-perl_3.10.2-1+deb13u2_riscv64.deb Checksums-Sha256: f130c187ff223b865e24a8670b4ec97247225f48f91d300c61ee236d19d90ecc 33560 cyrus-admin-dbgsym_3.10.2-1+deb13u2_riscv64.deb 669a1bd2d729f2c37764e3883bf15ccb8189c0896d18220f8cb725c7287b5463 88252 cyrus-admin_3.10.2-1+deb13u2_riscv64.deb ac89f3a52badad4db8a8670f7484f44df8c2b79e30436a09b4d38aa07505c4ff 1818644 cyrus-caldav-dbgsym_3.10.2-1+deb13u2_riscv64.deb f192392e75b9c40ad28ec4c40538be35c10c939ef50298dea6b5a13526576b4f 669048 cyrus-caldav_3.10.2-1+deb13u2_riscv64.deb e961bcb0bfa8098e514283e15feeb08c29e2862f185fbdda544a689cf0595548 57152 cyrus-clients-dbgsym_3.10.2-1+deb13u2_riscv64.deb f0e2ad641e1c19f1bc7d255dcd2136ec43b6b6abcc95bc7353e77749d7b52967 89640 cyrus-clients_3.10.2-1+deb13u2_riscv64.deb e9ad2cb9fb80b2fe9a0e203cef62b6f77ede06d294f9a345fe6196949d34945c 4200760 cyrus-common-dbgsym_3.10.2-1+deb13u2_riscv64.deb c1a5968bd98ac9b8d677ef0fcc85eef7660a8e810db966a4567814d5a85b1e4f 1449392 cyrus-common_3.10.2-1+deb13u2_riscv64.deb f9f4c8e80eb347c5ce02fa1831905b817030d6a304cc7b30e35f8aad8ab5113c 80616 cyrus-dev_3.10.2-1+deb13u2_riscv64.deb e2fdfed1af5318f572562cb132c061514028b33e3500bd75fbfc55d45307caa0 428844 cyrus-imapd-dbgsym_3.10.2-1+deb13u2_riscv64.deb 33e5b92525ea3c3dac581cdd726131b866c45a1166fc51e5df12fbe549f58b43 17319 cyrus-imapd_3.10.2-1+deb13u2_riscv64-buildd.buildinfo 5d3d00bdc120d47bf91dcc895aada66fcfd731d8bc4480c4c3f574855b9da4c8 219464 cyrus-imapd_3.10.2-1+deb13u2_riscv64.deb 11acf88dfff2758977bf68ea9282591d0d5a1c0b277e52c56729e8236407b105 64300 cyrus-murder-dbgsym_3.10.2-1+deb13u2_riscv64.deb 02fe70492c9c4a1e321aa7f809feec84531d6b070defb8f66d54ad2d7abadde8 76848 cyrus-murder_3.10.2-1+deb13u2_riscv64.deb e66e187c240afe8870a7f3ac21295d35d7c36d8800da411b3cd173c6e032a2ce 244600 cyrus-nntpd-dbgsym_3.10.2-1+deb13u2_riscv64.deb d1109e55c9637d90222f3a0929c25cf44d3a9e20098f374694a8311ed5918456 142792 cyrus-nntpd_3.10.2-1+deb13u2_riscv64.deb a829878e7347610770d024ae44f6c76fe8fcb3a8497a9b56938afbd54798c444 198032 cyrus-pop3d-dbgsym_3.10.2-1+deb13u2_riscv64.deb 74bdfe681af7c16dc22a9cc884ea374184aca02970cb78c57caedf568bdf7679 121228 cyrus-pop3d_3.10.2-1+deb13u2_riscv64.deb e44e858bcfa59f94b087ef1af3f0e7223383819a9ababa94bbc7d3a8109beee5 416388 cyrus-replication-dbgsym_3.10.2-1+deb13u2_riscv64.deb 326dac8bd6d8f62bfbaebf696126e12dca58d0a006ed0dd385d033e8043b22d5 144812 cyrus-replication_3.10.2-1+deb13u2_riscv64.deb 6dcb6dba0083df8fc2d639adb7e84fed1433f02931442798baae8c3efc499e78 450476 libcyrus-imap-perl-dbgsym_3.10.2-1+deb13u2_riscv64.deb a4a9700587a6d00591894ccf8cadf516b3112d26724c4b9d994087ad202dc67d 274160 libcyrus-imap-perl_3.10.2-1+deb13u2_riscv64.deb Files: c2117b0d051e6dea2bc7df71d9fad2cc 33560 debug optional cyrus-admin-dbgsym_3.10.2-1+deb13u2_riscv64.deb d9574eb246d099fc323ab3fc15b8b72d 88252 mail optional cyrus-admin_3.10.2-1+deb13u2_riscv64.deb ae129adbb2feb39181962b8328976ca1 1818644 debug optional cyrus-caldav-dbgsym_3.10.2-1+deb13u2_riscv64.deb b91ab03851a6b128180e3136f0bd6d6e 669048 mail optional cyrus-caldav_3.10.2-1+deb13u2_riscv64.deb 7ecc0dc541be402d0569ab9b9b21a162 57152 debug optional cyrus-clients-dbgsym_3.10.2-1+deb13u2_riscv64.deb 4f72a55a94703dcd235f1d9b980ad24c 89640 mail optional cyrus-clients_3.10.2-1+deb13u2_riscv64.deb 18d956058ee34094dc3681d35b395428 4200760 debug optional cyrus-common-dbgsym_3.10.2-1+deb13u2_riscv64.deb 2bd6e4563ec7bb37f3efd2d06e2fd2b9 1449392 mail optional cyrus-common_3.10.2-1+deb13u2_riscv64.deb c707bf5341cd0eff0b78266e039266ff 80616 devel optional cyrus-dev_3.10.2-1+deb13u2_riscv64.deb ab87c0526a3254d3a88c2171f657a24b 428844 debug optional cyrus-imapd-dbgsym_3.10.2-1+deb13u2_riscv64.deb d8f97476da954b8af7f4ca6aee1ba08d 17319 mail optional cyrus-imapd_3.10.2-1+deb13u2_riscv64-buildd.buildinfo 2759492c8d554c294214eb93ba789afe 219464 mail optional cyrus-imapd_3.10.2-1+deb13u2_riscv64.deb 2b21365b73ca483736e64292f2027eb9 64300 debug optional cyrus-murder-dbgsym_3.10.2-1+deb13u2_riscv64.deb 8b0c7923397673d365974eb6fe846f91 76848 mail optional cyrus-murder_3.10.2-1+deb13u2_riscv64.deb 89612e9cc15775e89d97bb9ebf4479f1 244600 debug optional cyrus-nntpd-dbgsym_3.10.2-1+deb13u2_riscv64.deb f14c107529bd9fa60670972420286621 142792 mail optional cyrus-nntpd_3.10.2-1+deb13u2_riscv64.deb 5fb706e8b1583ca3412f6d2309465741 198032 debug optional cyrus-pop3d-dbgsym_3.10.2-1+deb13u2_riscv64.deb 9d47c476f1673d309484eea3fcee70db 121228 mail optional cyrus-pop3d_3.10.2-1+deb13u2_riscv64.deb c775d6c0487cd7907ed3764f9240b4be 416388 debug optional cyrus-replication-dbgsym_3.10.2-1+deb13u2_riscv64.deb 2e666d686bcc1030b40a2f2df65cc355 144812 mail optional cyrus-replication_3.10.2-1+deb13u2_riscv64.deb e2192d4314570442cfeacebdce70e43d 450476 debug optional libcyrus-imap-perl-dbgsym_3.10.2-1+deb13u2_riscv64.deb 3e232bf9004f06e3505016d12f03eecc 274160 perl optional libcyrus-imap-perl_3.10.2-1+deb13u2_riscv64.deb -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEE3smN1vgomTkXJcrkIhSPlPtgqxkFAmqcP+kACgkQIhSPlPtg qxmPNw//TvWdNgZn+lw5TlJ/cCt0bXFWJE6mbwTzqdzxJ7/RWgz2eqzaC2oPeUic F1b5OfI/S1R1uzHiJJa2O5m7IuDhrds77JpadtWcRLpO6LLCPG4leoLYasJqhONA cmikJgGGRHd3pi27Kwtjz4VqcKv/ozpkkvUDRkmG6aQ1urAf+ec+Xqb79si2CWCu J6dhkz5aYB+GC1KI+NWCHy7uEgYmRwk1SzS+4fTLiJKaTpRYVvIddXSiQGyFG2mI UQnVgAMwQrcl4tztGNln17is9Gj29W4DDgKyjQogcoBWQ+Y4uEVX17HIzIgUROQk Rg3AaEwZklQtXIHAZppignMyezX+Eva0cSZXcc7QpgBlMUkjuOQWlfgqoBmRRMf5 RiMpR+Ku8Ks6V5wwdilvmZ0z1iZu9STjR9wYAbKqE2lx8hj9nTWXOzyMza0IirN8 L8tzOzfOJgC4Gbshz/41T/AhxMOQcjFbIBblkpdNfHY/YmcmgfsPgvIJsoZV+7od 2LdqD6bSMIX90uuiQwsATflw/x5wO8QyfDVs9O+gmu3gBvm9guRQ8ggmNr7q4wp9 K1+2nDzktnSCh2CSBdunhHuX60Ktg/Rnt2b1zJGGam20Auf+YWWeWBhBwNa05cvb 3L3fGfrcj626wVp/2dXN/L6U49Z1yejSGAmy9a5CZlbk9XavkSA= =B7yd -----END PGP SIGNATURE-----