[Git][security-tracker-team/security-tracker][master] Add new cyrus-imapd issues

[Salvatore Bonaccorso (@carnil)]

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
f0acc838 by Salvatore Bonaccorso at 2026-09-10T13:19:25+02:00
Add new cyrus-imapd issues

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -137,15 +137,25 @@ CVE-2026-71612 (Buffer Overflow vulnerability in GPAC c2dee3aff638cd96f9617ac5b1
 CVE-2026-67593 (A remote attacker can craft an Openwire RemoveSubscriptionInfo command ...)
 	TODO: check
 CVE-2026-61915 (An issue was discovered in Cyrus IMAP before 3.12.4. There is a VPATCH ...)
-	TODO: check
+	- cyrus-imapd <unfixed>
+	NOTE: https://www.cyrusimap.org/3.12/imap/download/release-notes/3.12/x/3.12.4.html
+	NOTE: https://www.cyrusimap.org/3.12/imap/download/release-notes/3.10/x/3.10.4.html
 CVE-2026-61911 (An issue was discovered in Cyrus IMAP before 3.12.4. There is a Sieve  ...)
-	TODO: check
+	- cyrus-imapd <unfixed>
+	NOTE: https://www.cyrusimap.org/3.12/imap/download/release-notes/3.12/x/3.12.4.html
+	NOTE: https://www.cyrusimap.org/3.12/imap/download/release-notes/3.10/x/3.10.4.html
 CVE-2026-61910 (An issue was discovered in Cyrus IMAP before 3.12.4. Mailbox/set let a ...)
-	TODO: check
+	- cyrus-imapd <unfixed>
+	NOTE: https://www.cyrusimap.org/3.12/imap/download/release-notes/3.12/x/3.12.4.html
+	NOTE: https://www.cyrusimap.org/3.12/imap/download/release-notes/3.10/x/3.10.4.html
 CVE-2026-61909 (An issue was discovered in Cyrus IMAP before 3.12.4. CalDAV/CardDAV mu ...)
-	TODO: check
+	- cyrus-imapd <unfixed>
+	NOTE: https://www.cyrusimap.org/3.12/imap/download/release-notes/3.12/x/3.12.4.html
+	NOTE: https://www.cyrusimap.org/3.12/imap/download/release-notes/3.10/x/3.10.4.html
 CVE-2026-61908 (An issue was discovered in Cyrus IMAP before 3.12.4. A JMAP email-head ...)
-	TODO: check
+	- cyrus-imapd <unfixed>
+	NOTE: https://www.cyrusimap.org/3.12/imap/download/release-notes/3.12/x/3.12.4.html
+	NOTE: https://www.cyrusimap.org/3.12/imap/download/release-notes/3.10/x/3.10.4.html
 CVE-2026-57967 (An unauthenticated remote attacker can craft a CORE protocol SESSION_R ...)
 	TODO: check
 CVE-2026-57822 (When the broker is processing message-based management requests, sent  ...)
@@ -598,7 +608,9 @@ CVE-2026-65181 (Insufficient authorization of Data Source tables in Impala 2.7-4
 CVE-2026-64857 (tirreno, a security framework, has a session fixation issue in version ...)
 	NOT-FOR-US: tirreno
 CVE-2026-61907 (An issue was discovered in Cyrus IMAP before 3.12.4. JMAP snooze bypas ...)
-	TODO: check
+	- cyrus-imapd <unfixed>
+	NOTE: https://www.cyrusimap.org/3.12/imap/download/release-notes/3.12/x/3.12.4.html
+	NOTE: https://www.cyrusimap.org/3.12/imap/download/release-notes/3.10/x/3.10.4.html
 CVE-2026-57866 (Server side request forgery in Apache Impala versions 4.4.x and 4.5.x. ...)
 	NOT-FOR-US: Apache software not packaged in Debian
 CVE-2026-56711 (VLC media player computes the size of a picture buffer with 32-bit ari ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/f0acc838ca29f727cc1e297e95e84a756892c054

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/f0acc838ca29f727cc1e297e95e84a756892c054
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20260910/3d87d5fb/attachment-0001.htm>