Release date:
2026-09-23 14:23:39 UTC
Description:
- fix CVE-2026-61915: double-free in the CalDAV VPATCH BYPARAM selector
- fix CVE-2026-61909: calendar/addressbook-multiget returned resources the user has no ACL on
- fix CVE-2026-61911: Sieve mailboxexists/metadata probed other users' mailboxes without a lookup-rights check
- do not free VPATCH parameters already removed by reference: libical frees them in icalproperty_remove_parameter_by_ref(), so the following icalparameter_free() aborted the CalDAV worker on any VPATCH carrying a PATCH-ACTION parameter, before the CVE-2026-61915 code path could be reached
- add the upstream cunit regression test for CVE-2026-61915
- run the cunit suite in %check even when cassandane is disabled, so the regression test above actually executes
Updated packages:
-
cyrus-imapd-3.4.8-2.el9_6.tuxcare.els1.x86_64.rpm
sha:6a202997aecd015e20e08a60b7e2cd6afd90868ac947d6585d23194afd7383ba
-
cyrus-imapd-devel-3.4.8-2.el9_6.tuxcare.els1.x86_64.rpm
sha:19028459d5d5d59fef182d3d33d5c9ae5774ef7b4bd787561cab700f23461a9d
-
cyrus-imapd-doc-extra-3.4.8-2.el9_6.tuxcare.els1.noarch.rpm
sha:ff361cb15b211faa6efa2582ba29d5b17721b7ae4553623447680458c2f9e0f0
-
cyrus-imapd-libs-3.4.8-2.el9_6.tuxcare.els1.i686.rpm
sha:189fb4502ec9dfd946d44b58cdc30ce22a9287ccca40f4c622e333d8461519f2
-
cyrus-imapd-libs-3.4.8-2.el9_6.tuxcare.els1.x86_64.rpm
sha:f0f6efcc28b80b56e354dd5e8cd76a52d39e287f9b9adc2707d3225210594206
-
cyrus-imapd-utils-3.4.8-2.el9_6.tuxcare.els1.x86_64.rpm
sha:3c2478f8f703ddda2e170ff40ff9510b6a2185b9a4c8cb7371e1f16a0ba9e653
-
cyrus-imapd-virusscan-3.4.8-2.el9_6.tuxcare.els1.x86_64.rpm
sha:2e8d3c1c60fc3238aced830bfbe00e63b4663d9b01c7e7788ab578f1c2ff90b9
-
perl-Cyrus-3.4.8-2.el9_6.tuxcare.els1.x86_64.rpm
sha:04649290765c1312cb92d6ffb6dbd28025162b450bb97be353675af9b8bc238c
Notes:
This page is generated automatically and has not been checked for errors. For clarification or
corrections please contact the
CloudLinux Packaging Team.
