{"id":"openSUSE-SU-2026:21929-1","summary":"Security update for cyrus-imapd","details":"This update for cyrus-imapd fixes the following issues:\n\nChanges in cyrus-imapd:\n\nUpdate to 3.8.8 (bugfix release):\n\n- CVE-2026-61907: JMAP snooze bypasses destination-mailbox ACL (bsc#1279908)\n- CVE-2026-61908: JMAP email-header blob ID out-of-bounds index (bsc#1279975)\n- CVE-2026-61909: CalDAV/CardDAV multiget bypasses per-href ACL (bsc#1279976)\n- CVE-2026-61910: Mailbox/set let sharee change special-use role on shared mailboxes (bsc#1279977)\n- CVE-2026-61911: Sieve mailbox existence oracle (bsc#1279978)\n- CVE-2026-61915: VPATCH BYPARAM double-free (bsc#1279979)\n","modified":"2026-09-25T18:23:14.142636484Z","published":"2026-09-22T15:42:33Z","related":["CVE-2026-61907","CVE-2026-61908","CVE-2026-61909","CVE-2026-61910","CVE-2026-61911","CVE-2026-61915"],"upstream":["CVE-2026-61907","CVE-2026-61908","CVE-2026-61909","CVE-2026-61910","CVE-2026-61911","CVE-2026-61915"],"references":[{"type":"ADVISORY"},{"type":"REPORT","url":"https://bugzilla.suse.com/1279908"},{"type":"REPORT","url":"https://bugzilla.suse.com/1279975"},{"type":"REPORT","url":"https://bugzilla.suse.com/1279976"},{"type":"REPORT","url":"https://bugzilla.suse.com/1279977"},{"type":"REPORT","url":"https://bugzilla.suse.com/1279978"},{"type":"REPORT","url":"https://bugzilla.suse.com/1279979"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-61907"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-61908"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-61909"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-61910"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-61911"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-61915"}],"affected":[{"package":{"name":"cyrus-imapd","ecosystem":"openSUSE:Leap 16.0","purl":"pkg:rpm/opensuse/cyrus-imapd&distro=openSUSE%20Leap%2016.0"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.8-bp160.1.1"}]}],"ecosystem_specific":{"binaries":[{"cyrus-imapd-devel":"3.8.8-bp160.1.1","cyrus-imapd-utils":"3.8.8-bp160.1.1","perl-Cyrus-Annotator":"3.8.8-bp160.1.1","perl-Cyrus-IMAP":"3.8.8-bp160.1.1","cyrus-imapd-snmp":"3.8.8-bp160.1.1","cyrus-imapd-snmp-mibs":"3.8.8-bp160.1.1","libcyrus0":"3.8.8-bp160.1.1","cyrus-imapd":"3.8.8-bp160.1.1","perl-Cyrus-SIEVE-managesieve":"3.8.8-bp160.1.1","cyradm":"3.8.8-bp160.1.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2026:21929-1.json"}}],"schema_version":"1.9.0"}