{"id":"openSUSE-SU-2026:20962-1","summary":"Security update for cyrus-imapd","details":"This update for cyrus-imapd fixes the following issues:\n\nChanges in cyrus-imapd:\n\n- cyrus-imapd don't start because of missing \"Requires=var-run.mount\" from systemd (bsc#1251788)\n  Remove var-run.mount from Requires and After\n\n- update to version 3.8.6 (bugfix release)\n  VUL-0: CVE-2025-49812: cyrus-imapd: Opossum Attack Application Layer\n  Desynchronization using Opportunistic TLS (bsc#1246165)\n  The industry is deprecating STARTTLS (aka opportunistic TLS) in favor of\n  implicit TLS over a dedicated port.  STARTTLS is now disabled by default.\n  * Fixed issue #5477: master: tighten up pidfile/etc handling (bsc#1241543)\n    VUL-0: cyrus-imapd: privilege drop happens too late, opening attack vectors from cyrus to root\n  * Fixed issue #5450: fix zoneinfo_db code for GCC 15 (thanks Yadd)\n  * Fixed issue #5309: deadlock on shutdown (thanks Mark Cammidge)\n  * Fixed issue #5424: recognise service-specific SASL options in\n    ``cyr_info conf-lint``\n  * Fixed issue #5420: fix double-free in http_admin (thanks Wolfgang Breyha)\n  * Fixed issue #5460: pop3d: add basic prometheus support (thanks Wolfgang\n    Breyha)\n  * Fixed issue #5454: httpd fails to parse OpenSSL version for status string\n\n- update to version 3.8.5 (bugfix release)\n  * Fixed Issue #5029: check for unexpected extra tiny-tests directories\n  * Fixed Issue #5148: added --enable-release-checks configure option for use when building releases\n  * Fixed Issue #4489: calendar-color \"changes\" namespace (thanks Дилян Палаузов)\n  * Fixed Issue #5009: various portability warnings and nits\n  * Fixed Issue #5050: iTIP line endings (thanks Дилян Палаузов)\n  * Fixed Issue #5052: iMIP line endings (thanks Дилян Палаузов)\n  * Fixed Issue #5072: http_cgi use after free (thanks Дилян Палаузов)\n  * Fixed Issue #5094: httpd crash when PROPFIND url is /dav/calendars\n  * Fixed Issue #5118: broken language checks for \"zr-hant\" and \"sr-me\"\n  * Fixed Issue #5047: proxying UID SEARCH\n\n- CVE-2025-23394: cyrus-imapd: daily-backup.sh allows escalation from cyrus to root (bsc#1241536)\n","modified":"2026-06-16T18:24:30.242927617Z","published":"2026-06-12T18:46:10Z","related":["CVE-2025-23394","CVE-2025-49812"],"upstream":["CVE-2025-23394","CVE-2025-49812"],"references":[{"type":"ADVISORY"},{"type":"REPORT","url":"https://bugzilla.suse.com/1241536"},{"type":"REPORT","url":"https://bugzilla.suse.com/1241543"},{"type":"REPORT","url":"https://bugzilla.suse.com/1246165"},{"type":"REPORT","url":"https://bugzilla.suse.com/1251788"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2025-23394"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2025-49812"}],"affected":[{"package":{"name":"cyrus-imapd","ecosystem":"openSUSE:Leap 16.0","purl":"pkg:rpm/opensuse/cyrus-imapd&distro=openSUSE%20Leap%2016.0"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.6-bp160.1.1"}]}],"ecosystem_specific":{"binaries":[{"cyrus-imapd":"3.8.6-bp160.1.1","cyrus-imapd-snmp-mibs":"3.8.6-bp160.1.1","cyradm":"3.8.6-bp160.1.1","libcyrus0":"3.8.6-bp160.1.1","perl-Cyrus-Annotator":"3.8.6-bp160.1.1","perl-Cyrus-SIEVE-managesieve":"3.8.6-bp160.1.1","cyrus-imapd-snmp":"3.8.6-bp160.1.1","cyrus-imapd-devel":"3.8.6-bp160.1.1","perl-Cyrus-IMAP":"3.8.6-bp160.1.1","cyrus-imapd-utils":"3.8.6-bp160.1.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2026:20962-1.json"}}],"schema_version":"1.7.5"}