-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Sun, 02 Aug 2026 12:00:00 +0200
Source: cyrus-imapd
Binary: cyrus-doc
Architecture: all
Version: 3.10.2-1+deb13u2
Distribution: trixie
Urgency: medium
Maintainer: all Build Daemon (x86-csail-02) <buildd_all-x86-csail-02@buildd.debian.org>
Changed-By: Edmund Lodewijks <edmund@proteamail.com>
Description:
 cyrus-doc  - Cyrus mail system - documentation files
Closes: 1142925
Changes:
 cyrus-imapd (3.10.2-1+deb13u2) trixie; urgency=medium
 .
   * Backport security fixes from upstream 3.10.3 (Closes: #1142925)
     (https://www.cyrusimap.org/imap/download/release-notes/3.10/x/3.10.3.html):
     - CVE-2026-47084: LOCALDELETE bypassed ACL checks, allowing non-admin
       users to delete mailboxes without permission.
     - CVE-2026-47086: GENURLAUTH issued URLAUTH tokens without checking
       ACL_READ on the target mailbox.
     - CVE-2026-47087: URLAUTH tokens kept working after the authorizer's
       access was revoked.
     - CVE-2026-47081: XAPPLEPUSHSERVICE allowed probing for mailbox
       existence and hijacking push notifications on other users' folders.
     - CVE-2026-47089: LISTRIGHTS was not restricted to users with admin
       access on the target mailbox.
     - CVE-2026-47085: URLAUTH tokens could be forged via a predictable
       empty mboxkey.
     - CVE-2026-47083: MULTISEARCH/ESEARCH allowed a cross-user folder and
       content enumeration oracle.
     - CVE-2026-47088: heap out-of-bounds read when parsing nested MIME
       comments in RFC 822 headers.
     - CVE-2026-47082: vacation "fcc" delivery skipped the ACL check on the
       destination mailbox.
   * This revision adds DEP-3 metadata to the new patches and restores
     upstream Cassandane regression tests that were missing from the initial
     debdiff (thanks, Codin!) for several of the fixes.
Checksums-Sha1:
 550b2182f40f3e915db7cd2bfeeb1f866313df65 303896 cyrus-doc_3.10.2-1+deb13u2_all.deb
 f7f8abbdfd57987e8eb9a0b7d88f1b423cd12e94 11001 cyrus-imapd_3.10.2-1+deb13u2_all-buildd.buildinfo
Checksums-Sha256:
 be084facae648fe3c7031da33c1b56908a4332c9870b4858c5b584908799aec7 303896 cyrus-doc_3.10.2-1+deb13u2_all.deb
 e4116877321e4fcf4b844587800b3baefc6164c961d1b3e64c85593795234bfb 11001 cyrus-imapd_3.10.2-1+deb13u2_all-buildd.buildinfo
Files:
 44766a02e08d00dbdd59780f62ec4ac5 303896 doc optional cyrus-doc_3.10.2-1+deb13u2_all.deb
 19415a7a168f73c1fc15704e62ec952b 11001 mail optional cyrus-imapd_3.10.2-1+deb13u2_all-buildd.buildinfo

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEXLxUpUHQBQBTDtd4aBVi67oXtfkFAmqcUqMACgkQaBVi67oX
tflnvQ/+J8Is/qlEHDdXLR91J8oAdW+O+KNnt8gsUI6D4brXrkP7EuGekgrYSi3F
1kGnSNZdCC7mr5AMcDQd9G5zqeQp29T8WPqGoOxHg1dIu9s94owfLPFfLWB4pCyi
5mw4BS+Q2p1DzGF7djJ1iVVIeKf5ScvQHKqJIcgIjw7XNvtdQun9SStig1iH9D+X
91eBl1h5mJv/9fy2xsAA0R2Tur2MyBvWcOpWfppYNM/poybdljX1810HgATAdf5S
N1yig0wyXSnXT1eoMZzzDPZIwlBt/FYnLvRre4sFGK19ANyQxQ1HOynf11r4KO/3
Xs9Eikgnn8AeBIMxQ9nwpeazP7t3YEpQX46eoZIndbvi6E6dvPu0X3mAxVxMQ30J
vP18xCUopRjKjgHmlAeBP1viBhlNtzRhbUfffgBH0MNA+WvpV6Kkevym12/usxEy
mJNe93zxakDhMEbj/QVJ4dPLaHZBLDNTWoOjiQkhg5Csig6ZzaHhDb7R8SYFQXIU
F98tjzGzpRKtnMyfX+JXbmu1C2pJa7sJpShvRxHqzMSeZTGPYtKt0QP8e9tJBieT
ZPiAkvq8EP4u5BQgJIEZrz/buOj1sKhI+ru2axfJHgL9NszEmmkecAxxzu1hVxoU
PHmRcijBdVZAWSuDb4O8XptlV1iyyjWd0w8D7zhm+8YxkTXjVig=
=dXQQ
-----END PGP SIGNATURE-----