openSUSE-SU-2026:20962-1

See a problem?
Import Source
https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2026:20962-1.json
JSON Data
https://api.test.osv.dev/v1/vulns/openSUSE-SU-2026:20962-1
Upstream
CVE (2)
Related
CVE (2)
Published
2026-06-12T18:46:10Z
Modified
2026-06-16T18:24:30Z
Summary
Security update for cyrus-imapd
Details

This update for cyrus-imapd fixes the following issues:

Changes in cyrus-imapd:

  • cyrus-imapd don't start because of missing "Requires=var-run.mount" from systemd (bsc#1251788) Remove var-run.mount from Requires and After

  • update to version 3.8.6 (bugfix release) VUL-0: CVE-2025-49812: cyrus-imapd: Opossum Attack Application Layer Desynchronization using Opportunistic TLS (bsc#1246165) The industry is deprecating STARTTLS (aka opportunistic TLS) in favor of implicit TLS over a dedicated port. STARTTLS is now disabled by default.

    • Fixed issue #5477: master: tighten up pidfile/etc handling (bsc#1241543) VUL-0: cyrus-imapd: privilege drop happens too late, opening attack vectors from cyrus to root
    • Fixed issue #5450: fix zoneinfo_db code for GCC 15 (thanks Yadd)
    • Fixed issue #5309: deadlock on shutdown (thanks Mark Cammidge)
    • Fixed issue #5424: recognise service-specific SASL options in cyr_info conf-lint
    • Fixed issue #5420: fix double-free in http_admin (thanks Wolfgang Breyha)
    • Fixed issue #5460: pop3d: add basic prometheus support (thanks Wolfgang Breyha)
    • Fixed issue #5454: httpd fails to parse OpenSSL version for status string

  • update to version 3.8.5 (bugfix release)

    • Fixed Issue #5029: check for unexpected extra tiny-tests directories
    • Fixed Issue #5148: added --enable-release-checks configure option for use when building releases
    • Fixed Issue #4489: calendar-color "changes" namespace (thanks Дилян Палаузов)
    • Fixed Issue #5009: various portability warnings and nits
    • Fixed Issue #5050: iTIP line endings (thanks Дилян Палаузов)
    • Fixed Issue #5052: iMIP line endings (thanks Дилян Палаузов)
    • Fixed Issue #5072: http_cgi use after free (thanks Дилян Палаузов)
    • Fixed Issue #5094: httpd crash when PROPFIND url is /dav/calendars
    • Fixed Issue #5118: broken language checks for "zr-hant" and "sr-me"
    • Fixed Issue #5047: proxying UID SEARCH

  • CVE-2025-23394: cyrus-imapd: daily-backup.sh allows escalation from cyrus to root (bsc#1241536)

References

Affected packages

openSUSE:Leap 16.0 / cyrus-imapd

Package

Name
cyrus-imapd
Purl
pkg:rpm/opensuse/cyrus-imapd&distro=openSUSE%20Leap%2016.0

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
3.8.6-bp160.1.1

Ecosystem specific 

{
    "binaries":  [
        {
            "cyradm":  "3.8.6-bp160.1.1",
            "cyrus-imapd":  "3.8.6-bp160.1.1",
            "cyrus-imapd-devel":  "3.8.6-bp160.1.1",
            "cyrus-imapd-snmp":  "3.8.6-bp160.1.1",
            "cyrus-imapd-snmp-mibs":  "3.8.6-bp160.1.1",
            "cyrus-imapd-utils":  "3.8.6-bp160.1.1",
            "libcyrus0":  "3.8.6-bp160.1.1",
            "perl-Cyrus-Annotator":  "3.8.6-bp160.1.1",
            "perl-Cyrus-IMAP":  "3.8.6-bp160.1.1",
            "perl-Cyrus-SIEVE-managesieve":  "3.8.6-bp160.1.1"
        }
    ]
}

Database specific

source 
"https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2026:20962-1.json"