CVS commit: pkgsrc/mail/cyrus-imapd310

["John Nemeth" <jnemeth%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   jnemeth
Date:           Mon Oct  5 02:13:36 UTC 2026

Modified Files:
        pkgsrc/mail/cyrus-imapd310: Makefile distinfo

Log Message:
Update to Cyrus IMAPd 3.10.4.

Cyrus IMAP 3.10.4 Release Notes

Changes since 3.10.3

Security fixes

     * CVE-2026-61907: JMAP snooze bypasses destination-mailbox ACL
       An authenticated user with insert permissions on another user's snoozed mailbox could cause
       insertion of mail to that user's inbox, or any other of their mailboxes whose id was known to
       the user, despite having no insert permissions to the target mailbox.
       Reported by: Michael Lynch (mtlynch.io).
     * CVE-2026-61908: JMAP email-header blob ID out-of-bounds index
       An authenticated user could attempt to download a specially crafted JMAP blob ID of the form
       H<emailid>-<index>, which could read past the end of the internal blob_headers array during
       download, exposing adjacent heap memory.
       Reported by: Ahmed Said.
     * CVE-2026-61909: CalDAV/CardDAV multiget bypasses per-href ACL
       An authenticated DAV user with some shared access to another user's calendar or address book
       could read even unshared events or contacts by including the target hrefs in a
       calendar-multiget or addressbook-multiget REPORT.
       Reported by: Ahmed Said.
     * CVE-2026-61910 Mailbox/set let sharee change special-use role on shared mailboxes
       An authenticated user with maySetKeywords on another user's mailbox could change that
       mailbox's specialuse annotation. This could allow the sharee to change the shared mailbox to
       perform the archived, snoozed, or other role, which might cause mail mail to be written to
       the shared mailbox, sharing more content than intended.
       This is likely to be an unusual situation, made more unusual because if the target already
       has an non-shared mailbox with that role, role duplication suppression will prevent the
       update.
       Reported by: Michael Lynch (mtlynch.io).
     * CVE-2026-61911 Sieve mailbox existence oracle
       An authenticated user could install a Sieve script that probed whether another user's private
       mailbox existed, or read the value of shared mailbox annotations, by observing which fileinto
       branch fired during LMTP delivery.
       Reported by: Michael Lynch (mtlynch.io).
     * CVE-2026-61915: VPATCH BYPARAM double-free
       An authenticated calendar user could crash a Cyrus CalDAV worker with a PATCH containing
       PATCH-ACTION="BYPARAM@..." against a resource with two or more properties of the matched
       kind. The memory holding the selector would be freed once on each iteration over the
       properties.
       Reported by: Michael Lynch (mtlynch.io).

Build changes

     * Fixed: Issue #5189: detect cld2 and wslay without pkg-config
     * Fixed: Issue #6142: build failure in lmtp_sieve on Alpine Linux

Bug fixes

     * Fixed: Issue #6064: escape JMAP logHeaders values before logging
     * Fixed: Issue #6165: JMAP EmailSubmission/set now reports bad rcptTo values as
       invalidRecipients rather than invalidProperties


To generate a diff of this commit:
cvs rdiff -u -r1.4 -r1.5 pkgsrc/mail/cyrus-imapd310/Makefile
cvs rdiff -u -r1.3 -r1.4 pkgsrc/mail/cyrus-imapd310/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/mail/cyrus-imapd310/Makefile
diff -u pkgsrc/mail/cyrus-imapd310/Makefile:1.4 pkgsrc/mail/cyrus-imapd310/Makefile:1.5
--- pkgsrc/mail/cyrus-imapd310/Makefile:1.4     Sat Jul 25 06:11:48 2026
+++ pkgsrc/mail/cyrus-imapd310/Makefile Mon Oct  5 02:13:36 2026
@@ -1,7 +1,6 @@
-# $NetBSD: Makefile,v 1.4 2026/07/25 06:11:48 mef Exp $
+# $NetBSD: Makefile,v 1.5 2026/10/05 02:13:36 jnemeth Exp $
 
-DISTNAME=      cyrus-imapd-3.10.2
-PKGREVISION=   2
+DISTNAME=      cyrus-imapd-3.10.4
 CATEGORIES=    mail
 MASTER_SITES=  ${MASTER_SITE_GITHUB:=cyrusimap/}
 GITHUB_TAG=    ${PKGNAME_NOREV}

Index: pkgsrc/mail/cyrus-imapd310/distinfo
diff -u pkgsrc/mail/cyrus-imapd310/distinfo:1.3 pkgsrc/mail/cyrus-imapd310/distinfo:1.4
--- pkgsrc/mail/cyrus-imapd310/distinfo:1.3     Sat Jul 25 06:11:48 2026
+++ pkgsrc/mail/cyrus-imapd310/distinfo Mon Oct  5 02:13:36 2026
@@ -1,8 +1,8 @@
-$NetBSD: distinfo,v 1.3 2026/07/25 06:11:48 mef Exp $
+$NetBSD: distinfo,v 1.4 2026/10/05 02:13:36 jnemeth Exp $
 
-BLAKE2s (cyrus-imapd-3.10.2.tar.gz) = b2b66f1d5fc812c711017f83a2f4e199eba49482bf2b5d6d7ae3ccc82b0c197e
-SHA512 (cyrus-imapd-3.10.2.tar.gz) = 8a3a1c70711362acbe095a52704c79952c0f9907758f69683421fbd1b65a9a33505491dcfe777413fb773a33b9794fc28967e5dd7e55ccddd6d01353decec1e5
-Size (cyrus-imapd-3.10.2.tar.gz) = 5228957 bytes
+BLAKE2s (cyrus-imapd-3.10.4.tar.gz) = acae350397c65229ec8fab6ee27b86d7ca1cec4311e7b97dc9825cfa4e001123
+SHA512 (cyrus-imapd-3.10.4.tar.gz) = 34b3cafb671e2ba9f4a3c03d7a2cefaa9f3a9584ef8fb843d32d35c242e4e63047e81345829fc5619bdeb0a47585090b020d5618608ab15390508ed149c9b605
+Size (cyrus-imapd-3.10.4.tar.gz) = 5235349 bytes
 SHA1 (patch-am) = d3571bc33ad3e053b719da5561af932bb946003b
 SHA1 (patch-ao) = c01c9d32b4d73cbc32d2ad8bfca8b8b021ca2474
 SHA1 (patch-aq) = bedd7e2d8e751577fa02f8f4cd91c00bd20b8a21