-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Sun, 02 Aug 2026 12:00:00 +0200 Source: cyrus-imapd Binary: cyrus-admin cyrus-admin-dbgsym cyrus-caldav cyrus-caldav-dbgsym cyrus-clients cyrus-clients-dbgsym cyrus-common cyrus-common-dbgsym cyrus-dev cyrus-imapd cyrus-imapd-dbgsym cyrus-murder cyrus-murder-dbgsym cyrus-nntpd cyrus-nntpd-dbgsym cyrus-pop3d cyrus-pop3d-dbgsym cyrus-replication cyrus-replication-dbgsym libcyrus-imap-perl libcyrus-imap-perl-dbgsym Architecture: s390x Version: 3.10.2-1+deb13u2 Distribution: trixie Urgency: medium Maintainer: s390x Build Daemon (zani) Changed-By: Edmund Lodewijks Description: cyrus-admin - Cyrus mail system - administration tools cyrus-caldav - Cyrus mail system - CalDAV and CardDAV support cyrus-clients - Cyrus mail system - test clients cyrus-common - Cyrus mail system - common files cyrus-dev - Cyrus mail system - developer files cyrus-imapd - Cyrus mail system - IMAP support cyrus-murder - Cyrus mail system - proxies and aggregator cyrus-nntpd - Cyrus mail system - NNTP support cyrus-pop3d - Cyrus mail system - POP3 support cyrus-replication - Cyrus mail system - replication libcyrus-imap-perl - Interface to Cyrus imap client imclient library Closes: 1142925 Changes: cyrus-imapd (3.10.2-1+deb13u2) trixie; urgency=medium . * Backport security fixes from upstream 3.10.3 (Closes: #1142925) (https://www.cyrusimap.org/imap/download/release-notes/3.10/x/3.10.3.html): - CVE-2026-47084: LOCALDELETE bypassed ACL checks, allowing non-admin users to delete mailboxes without permission. - CVE-2026-47086: GENURLAUTH issued URLAUTH tokens without checking ACL_READ on the target mailbox. - CVE-2026-47087: URLAUTH tokens kept working after the authorizer's access was revoked. - CVE-2026-47081: XAPPLEPUSHSERVICE allowed probing for mailbox existence and hijacking push notifications on other users' folders. - CVE-2026-47089: LISTRIGHTS was not restricted to users with admin access on the target mailbox. - CVE-2026-47085: URLAUTH tokens could be forged via a predictable empty mboxkey. - CVE-2026-47083: MULTISEARCH/ESEARCH allowed a cross-user folder and content enumeration oracle. - CVE-2026-47088: heap out-of-bounds read when parsing nested MIME comments in RFC 822 headers. - CVE-2026-47082: vacation "fcc" delivery skipped the ACL check on the destination mailbox. * This revision adds DEP-3 metadata to the new patches and restores upstream Cassandane regression tests that were missing from the initial debdiff (thanks, Codin!) for several of the fixes. Checksums-Sha1: db228e271b879864e6e08f59f428d296606745e4 33820 cyrus-admin-dbgsym_3.10.2-1+deb13u2_s390x.deb 63a63dea5c309f0e00c86bfc4992dff8ba551baa 88336 cyrus-admin_3.10.2-1+deb13u2_s390x.deb 36c4814ba0bdbda1ed8fb882243627b946c70d22 1869640 cyrus-caldav-dbgsym_3.10.2-1+deb13u2_s390x.deb f9fa94a5a58536c1c8d5becbc965d22f81f1b8b9 630244 cyrus-caldav_3.10.2-1+deb13u2_s390x.deb 3f82595198ec83f73cea65e310e154970f9ee44f 57612 cyrus-clients-dbgsym_3.10.2-1+deb13u2_s390x.deb 279c5418c117ebcc79981d0b039b440f3e3ad371 89452 cyrus-clients_3.10.2-1+deb13u2_s390x.deb 198feeeb870bf4e1f861a50cff33898d7e615576 4142240 cyrus-common-dbgsym_3.10.2-1+deb13u2_s390x.deb 05d112e51aa90f4806bf33e1919006adef23dc0a 1409916 cyrus-common_3.10.2-1+deb13u2_s390x.deb a14cd0b55164f7e6e75d626eefe377cbb042685b 80612 cyrus-dev_3.10.2-1+deb13u2_s390x.deb 28ae212b1888db600ab64a75c25b81f3b2c720df 422700 cyrus-imapd-dbgsym_3.10.2-1+deb13u2_s390x.deb 75bc5002e2d29bf5113ecd891269c9493c01966b 17097 cyrus-imapd_3.10.2-1+deb13u2_s390x-buildd.buildinfo b7e559d54141e3874be1ea194579675bda78a298 212688 cyrus-imapd_3.10.2-1+deb13u2_s390x.deb f33a52e77f8532b199513d7dc3cb08901b4a0a6a 63888 cyrus-murder-dbgsym_3.10.2-1+deb13u2_s390x.deb 9065bdd676ed8beac4638ee791d6b4a72613a91b 75976 cyrus-murder_3.10.2-1+deb13u2_s390x.deb 87339cc71c728002cb06e54609d53a60ba38348f 243972 cyrus-nntpd-dbgsym_3.10.2-1+deb13u2_s390x.deb 51ce9fbdc6740db421d399a014ff0a27de2f9b73 139912 cyrus-nntpd_3.10.2-1+deb13u2_s390x.deb 65cc6944c6c3a38dc19fe79b0840a3780f6704e8 201420 cyrus-pop3d-dbgsym_3.10.2-1+deb13u2_s390x.deb 6968626e7277c6ff0319cb4ae0b345d62a06b8d6 119376 cyrus-pop3d_3.10.2-1+deb13u2_s390x.deb 6aa502044212647b545298af09bac0a0dcd9162c 382968 cyrus-replication-dbgsym_3.10.2-1+deb13u2_s390x.deb a58f294dddffd0e6232020f1542fb95713c75f9b 139828 cyrus-replication_3.10.2-1+deb13u2_s390x.deb 73035d3452958db13a67e2f5c8426ae92aaac349 449288 libcyrus-imap-perl-dbgsym_3.10.2-1+deb13u2_s390x.deb 053c5683c4a865dcd6005dcba220e8aadb0437a4 273568 libcyrus-imap-perl_3.10.2-1+deb13u2_s390x.deb Checksums-Sha256: 5d6abeaf4007fb0b302461653f3d2704f565abd48a5b3761429310fb48f06df6 33820 cyrus-admin-dbgsym_3.10.2-1+deb13u2_s390x.deb eee252d98057de75235d14475533e79e19c1ed393a6cb5eec653e4b804b914ac 88336 cyrus-admin_3.10.2-1+deb13u2_s390x.deb a9f76d5c0ab12c066af5c58c3f398c3e2c4b230bf16119b9304d361e4c6c5c50 1869640 cyrus-caldav-dbgsym_3.10.2-1+deb13u2_s390x.deb a0fdcfb266793e29e375603332e1309a375d0e329833d6e802f32b9f46a6c043 630244 cyrus-caldav_3.10.2-1+deb13u2_s390x.deb 26695e03b602539a4ad219a85b739d20c0780ee1fe0f89c56e5694756638bce8 57612 cyrus-clients-dbgsym_3.10.2-1+deb13u2_s390x.deb c80eeff9d645e5810f63fc527954e46f6e4655aecb8595979a0f8db4e3d0758a 89452 cyrus-clients_3.10.2-1+deb13u2_s390x.deb 04352b007549c26d01b1344a90eecaa345c07cd89cb90852fffab994e9446779 4142240 cyrus-common-dbgsym_3.10.2-1+deb13u2_s390x.deb 6293a2c80a811eaa769bf9be9040c2f2f431a3b1566f2f54395361b5c7348a14 1409916 cyrus-common_3.10.2-1+deb13u2_s390x.deb 6fdd3b6627f21a3e19ee434ce36418a7c9ee39876583d1c537d0dda4b366c5b6 80612 cyrus-dev_3.10.2-1+deb13u2_s390x.deb 108468ead8eb19c4bfdaf19051d293dbbbc45a203f5f357ce69976c4f0be4531 422700 cyrus-imapd-dbgsym_3.10.2-1+deb13u2_s390x.deb 7e2ed02ded477de9aeac4b0a0c160763811844625d53b4d1db8a7dcd71c67b60 17097 cyrus-imapd_3.10.2-1+deb13u2_s390x-buildd.buildinfo 3bd0b529d5ee7e4e9b4fc422a42357d19c788f7189558726f67179613d25945f 212688 cyrus-imapd_3.10.2-1+deb13u2_s390x.deb 2ddc21f2e3c31f1149ed3d8e98f6384e98056af23f58362ab9f69a5392f2cdd7 63888 cyrus-murder-dbgsym_3.10.2-1+deb13u2_s390x.deb 4a096d43f6576561bdc4c14f85fb13f0e2691abe86cc7e4ac32a63fd3d90a823 75976 cyrus-murder_3.10.2-1+deb13u2_s390x.deb 2bd06f4a30820a7bad5e0147a17293bf2f34588fe5dd7c8641353a193c3acd64 243972 cyrus-nntpd-dbgsym_3.10.2-1+deb13u2_s390x.deb d321343afc1b88bd643dec3c2cafa093974d2154511147cc78d95d25db2c14fb 139912 cyrus-nntpd_3.10.2-1+deb13u2_s390x.deb 1e6dfef8bcfbc9381880cdca35e5d26b8d1f2de340f54713003012e5281aaa2a 201420 cyrus-pop3d-dbgsym_3.10.2-1+deb13u2_s390x.deb d79988505852d2115570dc40902d9ec03f747c9b02266c58aa085401312c707b 119376 cyrus-pop3d_3.10.2-1+deb13u2_s390x.deb ba72afa785e3d06662446832f633ccb3efc7b7d84eaaf0cd3d3732f6484e0e45 382968 cyrus-replication-dbgsym_3.10.2-1+deb13u2_s390x.deb f2b28f41d3ceff19b924045358fccf4a00c46095e15c5b9cf596b577cb73b769 139828 cyrus-replication_3.10.2-1+deb13u2_s390x.deb 70c9d267eba7ecab8b490912230c10b4e39d2c1fa17ea744605ae6c98848b76f 449288 libcyrus-imap-perl-dbgsym_3.10.2-1+deb13u2_s390x.deb 672f703cbb2176129529bd2a4f2a7ef32c6ce70f9c8f05f9003cb3ab23400291 273568 libcyrus-imap-perl_3.10.2-1+deb13u2_s390x.deb Files: 6a5e6eacd3a237fa645e6606cce28add 33820 debug optional cyrus-admin-dbgsym_3.10.2-1+deb13u2_s390x.deb befc82d8d340a81b0bdbce6efdb87e1d 88336 mail optional cyrus-admin_3.10.2-1+deb13u2_s390x.deb 505520318102817aefb0a98add287f01 1869640 debug optional cyrus-caldav-dbgsym_3.10.2-1+deb13u2_s390x.deb b29759deff90b6c90e6013a52dfe14d8 630244 mail optional cyrus-caldav_3.10.2-1+deb13u2_s390x.deb df860177e3def59a698db109a4f75ce3 57612 debug optional cyrus-clients-dbgsym_3.10.2-1+deb13u2_s390x.deb 3e8ebbe84823c1b8576d549eaf9d1e14 89452 mail optional cyrus-clients_3.10.2-1+deb13u2_s390x.deb 221ede5e8af6d8c9e4821b05f2696b31 4142240 debug optional cyrus-common-dbgsym_3.10.2-1+deb13u2_s390x.deb aa2aeafd938d6b6346d2b7655d695a62 1409916 mail optional cyrus-common_3.10.2-1+deb13u2_s390x.deb d58d99b749c8238bc2fe76ff088f6657 80612 devel optional cyrus-dev_3.10.2-1+deb13u2_s390x.deb 356e41db05be509b79d3499d16897a83 422700 debug optional cyrus-imapd-dbgsym_3.10.2-1+deb13u2_s390x.deb 2482cde79f6c8e61494346b3d5b4cd0a 17097 mail optional cyrus-imapd_3.10.2-1+deb13u2_s390x-buildd.buildinfo 0db7e44ff9bbc6300c2b504274b6fa77 212688 mail optional cyrus-imapd_3.10.2-1+deb13u2_s390x.deb fbaecdb9f9eab51d2e2ebe5ca9142f5b 63888 debug optional cyrus-murder-dbgsym_3.10.2-1+deb13u2_s390x.deb ba087859a179ee1d2feb6caa723808e2 75976 mail optional cyrus-murder_3.10.2-1+deb13u2_s390x.deb b84916af56ec7fa459ccc9ca51e39763 243972 debug optional cyrus-nntpd-dbgsym_3.10.2-1+deb13u2_s390x.deb 9f447484bbf6604fb0f34adf0db35b17 139912 mail optional cyrus-nntpd_3.10.2-1+deb13u2_s390x.deb 2da1a7f865af08f41dce50b5a36ae0ad 201420 debug optional cyrus-pop3d-dbgsym_3.10.2-1+deb13u2_s390x.deb 8cc3a9f7c65ed7c4642054674ad0247c 119376 mail optional cyrus-pop3d_3.10.2-1+deb13u2_s390x.deb 71305b8c571cc24372a27ef5875501fa 382968 debug optional cyrus-replication-dbgsym_3.10.2-1+deb13u2_s390x.deb 42febafed9a84975e196fc7b17863414 139828 mail optional cyrus-replication_3.10.2-1+deb13u2_s390x.deb 29a8077720b65593326260cb3dbae6e3 449288 debug optional libcyrus-imap-perl-dbgsym_3.10.2-1+deb13u2_s390x.deb 79eed885daea62d8a5031592f1d7784e 273568 perl optional libcyrus-imap-perl_3.10.2-1+deb13u2_s390x.deb -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEfUKc1SwkyxlVJBiWHOd5r2LlPicFAmqcOVEACgkQHOd5r2Ll Pif7OA/9EbaMuLQWTWtUH+OpCwQITPOb8z5Ea7GwQl9xSs3ULf7l0VhvsgQaUZlp ukEvl3L3bTL6HoZaSKkP8+uCf59dWLCZKxfO3+mb04KrVrrgcs93mz7+yaFPMD4r JOeHr0OHluNSaM12CxKdy/tMgusWG0NoVFNEmglBSiq/9U/oZqTktVt1dnPInnlQ 7/4iVHnM2nGfQbnuSsp05/sHj7SnuUQrSjd+uWJ2f2NGLV435bKHfXEZ3+SrAHNC i4l2OpZw/7yNDVZRLNk6PUvfoVxCrdVlM/XxGPAaiHJb5j4qmdr7cb9AlPV+mrRH bwdC690En0MV3Q0ADXHHtqwYl0JH2m7FxIMthJNHklFBmmneoDTWh4jnWHBFZqQ3 0qdU/ZMEuuSEvJi4+zW4WBcBPDIufHY7dLtbLMDnujApCV38SyUXq5fu+joQPylp wB/8nzLWdYYZQh6m44dMporVclzk0+0snnCqYFqdiHHNKWojK1nJU1ONPQJvm4Ew Oi/e+y6AWmcksPHXYtew4g+pLbdtd/u1KMx++mw+2rhA0GoJNA+2SQ3ukIGETqVN hvTGJI6XxIurQXDtlMHImtW4DjhXj4lovyEOFW5QS2ZIAqFO6JzUygADXhBXNhOe Ghti9Qdz/+WjjGMQZ/bdVDsau/vbPYCq8x8Ssh3U2kzvoXyeK8Q= =1edn -----END PGP SIGNATURE-----