Описание
Security update for cyrus-imapd
This update for cyrus-imapd fixes the following issues:
Changes in cyrus-imapd:
- Update to 3.8.7 (bugfix release)
- CVE-2026-47081: XAPPLEPUSHSERVICE folder existence oracle and push hijack (bsc#1271617)
- CVE-2026-47083: ESEARCH cross-user content oracle (bsc#1271619)
- CVE-2026-47082: Vacation "fcc" skips destination-mailbox ACL (bsc#1271618)
- CVE-2026-47084: LOCALDELETE bypassed ACL checks (bsc#1271620)
- CVE-2026-47085: URLAUTH token forgery via missing mboxkey (bsc#1271621)
- CVE-2026-47086: GENURLAUTH issued tokens bypassing ACLs (bsc#1271622)
- CVE-2026-47087: URLAUTH does not honor revoked authorizer access (bsc#1271623)
- CVE-2026-47088: Heap exposure in nested MIME comment parsing (bsc#1271624)
- CVE-2026-47089: LISTRIGHTS not limited to users with admin access (bsc#1271625)
Список пакетов
openSUSE Leap 16.0
Ссылки
- SUSE Security Ratings
- SUSE Bug 1271617
- SUSE Bug 1271618
- SUSE Bug 1271619
- SUSE Bug 1271620
- SUSE Bug 1271621
- SUSE Bug 1271622
- SUSE Bug 1271623
- SUSE Bug 1271624
- SUSE Bug 1271625
- SUSE CVE CVE-2026-47081 page
- SUSE CVE CVE-2026-47082 page
- SUSE CVE CVE-2026-47083 page
- SUSE CVE CVE-2026-47084 page
- SUSE CVE CVE-2026-47085 page
- SUSE CVE CVE-2026-47086 page
- SUSE CVE CVE-2026-47087 page
- SUSE CVE CVE-2026-47088 page
- SUSE CVE CVE-2026-47089 page
Описание
An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. There is an XAPPLEPUSHSERVICE folder existence oracle and push hijack. An authenticated IMAP user could probe for the existence of arbitrary mailboxes on other users' accounts via the XAPPLEPUSHSERVICE command and then create Apple Push Notification Service notifications for new mail in those mailboxes to their own APNS device. This did not leak any data about the content of mailboxes. Instead, a "mailbox has changed" notice would be pushed when the mailbox modseq changed.
Затронутые продукты
Ссылки
- CVE-2026-47081
- SUSE Bug 1271617
Описание
An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. The vacation "fcc" feature skips the destination-mailbox ACL. A user whose vacation Sieve script used :fcc (to save a copy of the sent message) could deliver vacation auto-reply copies into any mailbox the script could name, regardless of whether the script owner had insert permissions on the destination mailbox.
Затронутые продукты
Ссылки
- CVE-2026-47082
- SUSE Bug 1271618
Описание
An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. There is an ESEARCH cross-user content oracle. By using the ESEARCH command, an authenticated IMAP user could enumerate folder names under any account they could name. Search would return UIDs of messages matching the search, creating a content oracle (without allowing arbitrary reads of the target's content).
Затронутые продукты
Ссылки
- CVE-2026-47083
- SUSE Bug 1271619
Описание
An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. The LOCALDELETE command bypassed ACL checks. An authenticated but non-admin user could invoke the admin-only LOCALDELETE IMAP command and delete mailboxes for which they had no permissions.
Затронутые продукты
Ссылки
- CVE-2026-47084
- SUSE Bug 1271620
Описание
An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. URLAUTH token forgery can occur via a missing mboxkey. If an attacker knew a folder name on the victim's account for which the victim had never issued an auth URL, they could forge a working URLAUTH token by computing an HMAC-SHA1 value with a predictable key, giving them read access to the mailbox. (URLAUTH is an obscure feature, meaning that the odds of any user actually being susceptible to this attack are very low. Perhaps no public clients use URLAUTH.)
Затронутые продукты
Ссылки
- CVE-2026-47085
- SUSE Bug 1271621
Описание
An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. GENURLAUTH-issued tokens can bypass ACLs. Any authenticated user could mint a URLAUTH token (via the GENURLAUTH command) for any mailbox they could name, even without read access on it. This would allow reading mail from mailboxes despite having no granted permissions.
Затронутые продукты
Ссылки
- CVE-2026-47086
- SUSE Bug 1271622
Описание
An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. URLAUTH does not honor revoked authorizer access. A URLAUTH URL minted while the authorizer had access continued to work after that access was revoked.
Затронутые продукты
Ссылки
- CVE-2026-47087
- SUSE Bug 1271623
Описание
An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. There is heap exposure in nested MIME comment parsing. An authenticated IMAP user could craft an email message containing an RFC 822 comment ending with a backslash. When parsing the message, the server would read past the message's end in memory, and read into the heap, returning the read content to the user.
Затронутые продукты
Ссылки
- CVE-2026-47088
- SUSE Bug 1271624
Описание
An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. LISTRIGHTS os not limited to users with admin access. An authenticated user could call IMAP LISTRIGHTS against any mailbox they could name and learn what principals had what access to it. (This action should have been restricted to users with admin access on the target mailbox.)
Затронутые продукты
Ссылки
- CVE-2026-47089
- SUSE Bug 1271625