#1147283 cyrus-imapd: diff for point release update 3.10.2-1+deb13u3

Package:
release.debian.org
Source:
release.debian.org
Submitter:
Edmund Lodewijks
Date:
2026-09-11 09:27:01 UTC
Severity:
normal
Tags:
#1147283#5
Date:
2026-09-10 11:45:31 UTC
From:
To:
Please consider cyrus-imapd 3.10.2-1+deb13u3 for trixie.

This stacks on top of the already-accepted 3.10.2-1+deb13u2 (ack'ed
by Adam D. Barratt on bug #1142925, accepted into proposed-updates
on 2026-09-05, still awaiting the next point release). This does not
replace or conflict with it.

It backports six new CVEs fixed upstream in 3.10.4, none of which
overlap with the CVE-2026-47081..47089 batch already in deb13u2:

   * CVE-2026-61907: JMAP snooze bypassed the destination mailbox's
     ACL, letting a sharee insert mail into mailboxes they had no
     insert rights on.
   * CVE-2026-61908: heap out-of-bounds read via a crafted JMAP
     email-header blob ID index.
   * CVE-2026-61909: CalDAV/CardDAV multiget did not check per-href
     ACLs, letting a partially-shared user read unshared events or
     contacts.
   * CVE-2026-61910: Mailbox/set let a sharee with maySetKeywords
     change a shared mailbox's special-use role.
   * CVE-2026-61911: Sieve mailboxexists/metadata let a script probe
     another user's mailbox existence or read shared annotations.
   * CVE-2026-61915: double-free in VPATCH BYPARAM handling could
     crash a CalDAV worker.

The debdiff also includes one small, non-CVE fix: a pre-existing
double-free in ical_support.c's parameter cleanup (present since at
least 3.10.2), needed for the CVE-2026-61915 upstream regression test
to actually pass. No code path previously exercised it. Fixed
upstream in commit 4f9fd773047cb8d2f73b00cee4bc2adc1893fb65.

Built and tested clean via sbuild against a local stable chroot;
lintian warnings are pre-existing and unrelated to this diff. debdiff
attached below.

Kind regards,

     Edmund
#1147283#12
Date:
2026-09-11 03:05:36 UTC
From:
To:
Hi Edmund,

FWIW, before this can be accepted for trixie the issues need to be
fixed as well in unstable, I see it is pending in the packaging
repository by Xavier, so I guess an upload is imminent as well?

Regards,
Salvatore
#1147283#17
Date:
2026-09-11 08:46:30 UTC
From:
To:
Hi Salvatore,

Ah, so much to remember! My apologies.

I saw Xavier had packaged for unstable so I thought I’d do the Trixie pu.

I have cc’d Xavier.

Kind regards,

    Edmund
#1147283#22
Date:
2026-09-11 09:24:05 UTC
From:
To:
Le 11/09/2026 à 10:46, Edmund Lodewijks a écrit :

Hi,

I just pushed it (I didn't bring my Yubikey this week).

Cheers,
Xavier