pkgsrc-Changes archive
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index][Old Index]
CVS commit: pkgsrc/mail/cyrus-imapd312
Module Name: pkgsrc
Committed By: jnemeth
Date: Mon Oct 5 02:43:47 UTC 2026
Modified Files:
pkgsrc/mail/cyrus-imapd312: Makefile distinfo
Log Message:
cyrus-imapd312: Update to Cyrus IMAPd 3.12.4.
____________________________________________________________________________________________
Cyrus IMAP 3.12.4 Release Notes
Changes since 3.12.3
Security fixes
* CVE-2026-61907: JMAP snooze bypasses destination-mailbox ACL
An authenticated user with insert permissions on another user's snoozed mailbox could cause
insertion of mail to that user's inbox, or any other of their mailboxes whose id was known to
the user, despite having no insert permissions to the target mailbox.
Reported by: Michael Lynch (mtlynch.io).
* CVE-2026-61908: JMAP email-header blob ID out-of-bounds index
An authenticated user could attempt to download a specially crafted JMAP blob ID of the form
H<emailid>-<index>, which could read past the end of the internal blob_headers array during
download, exposing adjacent heap memory.
Reported by: Ahmed Said.
* CVE-2026-61909: CalDAV/CardDAV multiget bypasses per-href ACL
An authenticated DAV user with some shared access to another user's calendar or address book
could read even unshared events or contacts by including the target hrefs in a
calendar-multiget or addressbook-multiget REPORT.
Reported by: Ahmed Said.
* CVE-2026-61910 Mailbox/set let sharee change special-use role on shared mailboxes
An authenticated user with maySetKeywords on another user's mailbox could change that
mailbox's specialuse annotation. This could allow the sharee to change the shared mailbox to
perform the archived, snoozed, or other role, which might cause mail mail to be written to
the shared mailbox, sharing more content than intended.
This is likely to be an unusual situation, made more unusual because if the target already
has an non-shared mailbox with that role, role duplication suppression will prevent the
update.
Reported by: Michael Lynch (mtlynch.io).
* CVE-2026-61911 Sieve mailbox existence oracle
An authenticated user could install a Sieve script that probed whether another user's private
mailbox existed, or read the value of shared mailbox annotations, by observing which fileinto
branch fired during LMTP delivery.
Reported by: Michael Lynch (mtlynch.io).
* CVE-2026-61915: VPATCH BYPARAM double-free
An authenticated calendar user could crash a Cyrus CalDAV worker with a PATCH containing
PATCH-ACTION="BYPARAM@..." against a resource with two or more properties of the matched
kind. The memory holding the selector would be freed once on each iteration over the
properties.
Reported by: Michael Lynch (mtlynch.io).
Build changes
* Fixed: Issue #6142: build failure in lmtp_sieve on Alpine Linux
Bug fixes
* Fixed: Issue #6064: escape JMAP logHeaders values before logging
* Fixed: Issue #6165: JMAP EmailSubmission/set now reports bad rcptTo values as
invalidRecipients rather than invalidProperties
* Fixed: Issue #6334: JMAP CalendarEvent/set crash when participants.sendTo malformed
____________________________________________________________________________________________
Cyrus IMAP 3.12.3 Release Notes
Changes since 3.12.2
Security fixes
* CVE-2026-47084 LOCALDELETE bypassed ACL checks
An authenticated but non-admin user could invoke the admin-only LOCALDELETE IMAP command and
delete mailboxes for which they had no permissions.
Reported by: Michael Lynch (mtlynch.io)
* CVE-2026-47086 GENURLAUTH issued tokens bypassing ACLs
Any authenticated user could mint a URLAUTH token (via the GENURLAUTH command) for any
mailbox they could name, even without read access on it. This would allow reading mail from
mailboxes despite having no granted permissions.
Reported by: Matthew Horsfall
* CVE-2026-47087 URLAUTH does not honor revoked authorizer access
A URLAUTH URL minted while the authorizer had access continued to work after that access was
revoked.
Reported by: Matthew Horsfall
* CVE-2026-47081 XAPPLEPUSHSERVICE folder existence oracle and push hijack
An authenticated IMAP user could probe for the existence of arbitrary mailboxes on other
users' accounts via the XAPPLEPUSHSERVICE command and then create Apple Push Notification
Service notifications for new mail in those mailboxes to their own APNS device. This did not
leak any data about the content of mailboxes. Instead, a "mailbox has changed" notice would
be pushed when the mailbox modseq changed.
Reported by Matthew Horsfall.
* CVE-2026-47089 LISTRIGHTS not limited to users with admin access
An authenticated user could call IMAP LISTRIGHTS against any mailbox they could name and
learn what principals had what access to it. (This action should have been restricted to
users with admin access on the target mailbox.)
Reported by: Matthew Horsfall
* CVE-2026-47085 URLAUTH token forgery via missing mboxkey
If an attacker knew a folder name on the victim's account for which the victim had never
issued an auth URL, they could forge a working URLAUTH token by computing HMAC-SHA1 with a
predictable key, allowing them read access to the mailbox.
URLAUTH is an obscure feature, meaning that the odds of any user actually being susceptible
to this attack are very low. We are unaware of any clients using URLAUTH.
Reported by: Matthew Horsfall
* CVE-2026-47083 ESEARCH cross-user content oracle
Using the ESEARCH command, an authenticated IMAP user could enumerate folder names under any
account they could name. Search would return UIDs of messages matching search, creating a
content oracle without allowing arbitrary reads of the target's content.
Reported by: Michael Lynch (mtlynch.io)
* CVE-2026-47088 Heap exposure in nested MIME comment parsing
An authenticated IMAP user could specially craft an email containing an RFC 822 comment
ending with a backslash. When parsing the message, the server would read past the message end
in memory and read into the heap, returning the read content to the user.
Reported by: Michael Lynch (mtlynch.io).
* CVE-2026-47082 Vacation "fcc" skips destination-mailbox ACL
A user whose vacation Sieve script used :fcc (to save a copy of the sent message) could
deliver vacation auto-reply copies into any mailbox the script could name, regardless of
whether the script owner had insert permissions on the destination mailbox.
Reported by: Michael Lynch (mtlynch.io)
Build changes
* Fixed: Issue #5262: fix cunit+valgrind libtool invocation
* Fixed: Issue #5646: update cunit valgrind suppressions
Bug fixes
* Fixed: Issue #5908: auditlog rename of UUID mailboxes
* Fixed: Issue #5922: prohibit APPEND/COPY/MOVE into non-IMAP mailboxes
* Fixed: Issue #5437: don't leak cached TLS sessions
* Fixed: Issue #5436: fix leaks in imap SELECT and SETQUOTA
* Fixed: Issue #6022: various memory leaks
____________________________________________________________________________________________
Cyrus IMAP 3.12.2 Release Notes
Changes since 3.12.1
Security fixes
* Fixed Issue #5495: MBTYPE_INTERMEDIATE mailboxes could be renamed by users without the
expected ACL_DELETEMBOX permission.
Build changes
* Fixed Issue #5500: cassandane failures on Ubuntu 24 LTS
* Fixed Issue #5512: distcheck now runs the unit tests
* Added: configure --with-zoneinfo-dir option to set zoneinfo_dir at compile time
* Fixed Issue #5733: compiler warning when optimizations enabled
* Fixed Issue #5727: cross-version cassandane support was broken
* Fixed Issue #5750: cross-version cassandane can now conditionalise tests on both versions
Bug fixes
* Fixed: lmtpd(8) now uses the session id that it logged
* Fixed Issue #4787: VANISHED not working with cyrus proxy
* Fixed Issue #5602: LIST (SUBSCRIBED) not working with cyrus proxy
* Fixed Issue #3562: imapd(8) crash when searching for flags (thanks Sven Wegener)
* Fixed Issue #5816: Xapian indexing broken on platforms without posix_fadvise() (thanks Angelo
Gruendler)
* Fixed Issue #5789: mupdate(8) crash on DEACTIVATE (thanks Zisis Vakras)
To generate a diff of this commit:
cvs rdiff -u -r1.4 -r1.5 pkgsrc/mail/cyrus-imapd312/Makefile
cvs rdiff -u -r1.3 -r1.4 pkgsrc/mail/cyrus-imapd312/distinfo
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
Modified files:
Index: pkgsrc/mail/cyrus-imapd312/Makefile
diff -u pkgsrc/mail/cyrus-imapd312/Makefile:1.4 pkgsrc/mail/cyrus-imapd312/Makefile:1.5
--- pkgsrc/mail/cyrus-imapd312/Makefile:1.4 Sun Jul 26 02:43:18 2026
+++ pkgsrc/mail/cyrus-imapd312/Makefile Mon Oct 5 02:43:47 2026
@@ -1,7 +1,6 @@
-# $NetBSD: Makefile,v 1.4 2026/07/26 02:43:18 mef Exp $
+# $NetBSD: Makefile,v 1.5 2026/10/05 02:43:47 jnemeth Exp $
-DISTNAME= cyrus-imapd-3.12.1
-PKGREVISION= 1
+DISTNAME= cyrus-imapd-3.12.4
CATEGORIES= mail
MASTER_SITES= ${MASTER_SITE_GITHUB:=cyrusimap/}
GITHUB_TAG= ${PKGNAME_NOREV}
Index: pkgsrc/mail/cyrus-imapd312/distinfo
diff -u pkgsrc/mail/cyrus-imapd312/distinfo:1.3 pkgsrc/mail/cyrus-imapd312/distinfo:1.4
--- pkgsrc/mail/cyrus-imapd312/distinfo:1.3 Sun Jul 26 02:43:18 2026
+++ pkgsrc/mail/cyrus-imapd312/distinfo Mon Oct 5 02:43:47 2026
@@ -1,8 +1,8 @@
-$NetBSD: distinfo,v 1.3 2026/07/26 02:43:18 mef Exp $
+$NetBSD: distinfo,v 1.4 2026/10/05 02:43:47 jnemeth Exp $
-BLAKE2s (cyrus-imapd-3.12.1.tar.gz) = 24d07259b14e762f1ed59becd9ba14ec7d1e799bd73bba3f32d0535a97259b16
-SHA512 (cyrus-imapd-3.12.1.tar.gz) = 3089cbe79c176b4af922700426e04fa69cfe2aa23ddf393077499f7489228ad301402abbd3a17d8797700b77dcaabbe31540276e287e7bec79571a372dc37e82
-Size (cyrus-imapd-3.12.1.tar.gz) = 5232294 bytes
+BLAKE2s (cyrus-imapd-3.12.4.tar.gz) = 47eefe8cd63b9c1b62101bbb0ecb421a2f0ac89e3a4256012016d400405b27aa
+SHA512 (cyrus-imapd-3.12.4.tar.gz) = 3c12d32bff5bd6cdad341837ea0849d9ee1b2b26fe110396d72eb52bafff74b75c841366fa2fbd4a5bc0bf722f45a5274a7c361ec0f5f3521fefb3d10215013f
+Size (cyrus-imapd-3.12.4.tar.gz) = 5242834 bytes
SHA1 (patch-Makefile.am) = 05f5cb3676b3f2e226d5966740841aafa7dde843
SHA1 (patch-configure.ac) = 90f3c579d5a53141ac78514a404a4ef71e1212fd
SHA1 (patch-docsrc_conf.py) = 5474342cb1bb99e8e54ff4b011463bb0a5131a9c
Home |
Main Index |
Thread Index |
Old Index