Packages / Debian 12 (Bookworm) / mail / cyrus-common

Package: cyrus-common (3.6.1-4+deb12u4)

Cyrus mail system - common files

Other Packages Related to cyrus-common:

dep: [adduser]
add and remove users and groups
dep: [db-util]
Berkeley Database Utilities
dep: [e2fsprogs]
ext2/ext3/ext4 file system utilities
dep: default-mta
Package not available
dep: mail-transport-agent
Package not available
dep: [gawk]
GNU awk, a pattern scanning and processing language
dep: [libsasl2-modules]
Cyrus SASL - pluggable authentication modules
dep: [lsb-base]
transitional package for Linux Standard Base init script functionality
dep: [netbase]
Basic TCP/IP networking system
dep: [debconf] (>= 0.5)
Debian configuration management system
dep: debconf-2.0
Package not available
dep: [perl] [any]
Larry Wall's Practical Extraction and Report Language
dep: [libc6] (>= 2.34)
GNU C Library: Shared libraries
dep: [libclamav12] (>= 1.2.1)
anti-virus utility for Unix - library
dep: [libcom-err2] (>= 1.43.9)
common error description library
dep: [libgcc-s1] (>= 3.0)
GCC support library
dep: [libical3] (>= 3.0.0)
iCalendar library implementation in C (runtime)
dep: [libicu72] (>= 72.1~rc-1~)
International Components for Unicode
dep: [libjansson4] (>= 2.14)
C library for encoding, decoding and manipulating JSON data
dep: [libkrb5-3] (>= 1.6.dfsg.2)
MIT Kerberos runtime libraries
dep: [libldap-2.5-0] (>= 2.5.4)
OpenLDAP libraries
dep: [libpcre3]
Old Perl 5 Compatible Regular Expression Library - runtime files
dep: [libpq5]
PostgreSQL C client library
dep: [libsasl2-2] (>= 2.1.28+dfsg)
Cyrus SASL - authentication abstraction library
dep: [libsqlite3-0] (>= 3.6.0)
SQLite 3 shared library
dep: [libssl3] (>= 3.0.0)
Secure Sockets Layer toolkit - shared libraries
dep: [libstdc++6] (>= 5.2)
GNU Standard C++ Library v3
dep: [libwrap0] (>= 7.6-4~)
Wietse Venema's TCP wrappers library
dep: [libxapian30] (>= 1.4.19~)
Search engine library
dep: [libxml2] (>= 2.7.4)
GNOME XML library
dep: [libzephyr4]
Project Athena's notification service - non-Kerberos libraries
dep: [zlib1g] (>= 1:1.2.6)
compression library - runtime

rec: [cyrus-imapd]
Cyrus mail system - IMAP support
rec: [cyrus-pop3d]
Cyrus mail system - POP3 support
rec: [cyrus-murder]
Cyrus mail system - proxies and aggregator
rec: [cyrus-nntpd]
Cyrus mail system - NNTP support
rec: [cyrus-admin]
Cyrus mail system - administration tools
rec: [cyrus-caldav]
Cyrus mail system - CalDAV and CardDAV support

sug: [apt-listchanges]
package change history notification tool
sug: [cyrus-admin]
Cyrus mail system - administration tools
sug: [cyrus-caldav]
Cyrus mail system - CalDAV and CardDAV support
sug: [cyrus-clients]
Cyrus mail system - test clients
sug: [cyrus-doc]
Cyrus mail system - documentation files
sug: [cyrus-imapd]
Cyrus mail system - IMAP support
sug: [cyrus-murder]
Cyrus mail system - proxies and aggregator
sug: [cyrus-nntpd]
Cyrus mail system - NNTP support
sug: [cyrus-pop3d]
Cyrus mail system - POP3 support
sug: [cyrus-replication]
Cyrus mail system - replication
sug: [sasl2-bin]
Cyrus SASL - administration programs for SASL users database

Download cyrus-common

Architecture	Package size	Installed size	Files	Package
amd64	1.3 MiB	5.5 MiB	list of files	Download
arm64	1.2 MiB	7.4 MiB	list of files	Download

Package file paths (154)

Paths come from the repository package-file index for the observed builds. They describe archive/package associations, not every file that will exist on a running system after maintainer scripts, alternatives, generated state, diversions, or installation choices.

/etc/cron.daily/cyrus-imapd
/etc/cyrus.conf
/etc/default/cyrus-imapd
/etc/imapd.conf
/etc/init.d/cyrus-imapd
/etc/logcheck/ignore.d.server/cyrus-imapd
/etc/logcheck/violations.ignore.d/cyrus-common
/etc/logcheck/violations.ignore.d/cyrus-imapd
/etc/pam.d/lmtp
/etc/pam.d/sieve
/etc/sieve
/lib/systemd/system/cyrus-imapd.service
/usr/lib/aarch64-linux-gnu/libcyrus_imap.so.0
/usr/lib/aarch64-linux-gnu/libcyrus_imap.so.0.0.0
/usr/lib/aarch64-linux-gnu/libcyrus_min.so.0
/usr/lib/aarch64-linux-gnu/libcyrus_min.so.0.0.0
/usr/lib/aarch64-linux-gnu/libcyrus_sieve.so.0
/usr/lib/aarch64-linux-gnu/libcyrus_sieve.so.0.0.0
/usr/lib/aarch64-linux-gnu/libcyrus.so.0
/usr/lib/aarch64-linux-gnu/libcyrus.so.0.0.0
/usr/lib/cyrus/bin/arbitron
/usr/lib/cyrus/bin/arbitronsort
/usr/lib/cyrus/bin/backupd
/usr/lib/cyrus/bin/calalarmd
/usr/lib/cyrus/bin/chk_cyrus
/usr/lib/cyrus/bin/ctl_backups
/usr/lib/cyrus/bin/ctl_conversationsdb
/usr/lib/cyrus/bin/ctl_cyrusdb
/usr/lib/cyrus/bin/ctl_deliver
/usr/lib/cyrus/bin/ctl_mboxlist
/usr/lib/cyrus/bin/ctl_zoneinfo
/usr/lib/cyrus/bin/cvt_cyrusdb
/usr/lib/cyrus/bin/cvt_xlist_specialuse
/usr/lib/cyrus/bin/cyr_backup
/usr/lib/cyrus/bin/cyr_buildinfo
/usr/lib/cyrus/bin/cyr_cd.sh
/usr/lib/cyrus/bin/cyr_dbtool
/usr/lib/cyrus/bin/cyr_deny
/usr/lib/cyrus/bin/cyr_df
/usr/lib/cyrus/bin/cyrdump
/usr/lib/cyrus/bin/cyr_expire
/usr/lib/cyrus/bin/cyr_info
/usr/lib/cyrus/bin/cyr_ls
/usr/lib/cyrus/bin/cyr_pwd
/usr/lib/cyrus/bin/cyr_userseen
/usr/lib/cyrus/bin/cyr_virusscan
/usr/lib/cyrus/bin/deliver
/usr/lib/cyrus/bin/fud
/usr/lib/cyrus/bin/ipurge
/usr/lib/cyrus/bin/lmtpd
/usr/lib/cyrus/bin/makedirs
/usr/lib/cyrus/bin/master
/usr/lib/cyrus/bin/mbexamine
/usr/lib/cyrus/bin/mbpath
/usr/lib/cyrus/bin/mbtool
/usr/lib/cyrus/bin/notifyd
/usr/lib/cyrus/bin/ptdump
/usr/lib/cyrus/bin/ptexpire
/usr/lib/cyrus/bin/ptloader
/usr/lib/cyrus/bin/quota
/usr/lib/cyrus/bin/reconstruct
/usr/lib/cyrus/bin/relocate_by_id
/usr/lib/cyrus/bin/restore
/usr/lib/cyrus/bin/sievec
/usr/lib/cyrus/bin/sieved
/usr/lib/cyrus/bin/smmapd
/usr/lib/cyrus/bin/timsieved
/usr/lib/cyrus/bin/tls_prune
/usr/lib/cyrus/bin/unexpunge
/usr/lib/cyrus/bin/upgrade-db
/usr/lib/cyrus/cyrus-db-types.txt
/usr/lib/cyrus/cyrus-hardwired-config.txt
/usr/lib/cyrus/get-backtrace.gdb
/usr/lib/cyrus/upgrade/masssievec
/usr/lib/cyrus/upgrade/rehash
/usr/lib/cyrus/upgrade/translatesieve
/usr/lib/x86_64-linux-gnu/libcyrus_imap.so.0
/usr/lib/x86_64-linux-gnu/libcyrus_imap.so.0.0.0
/usr/lib/x86_64-linux-gnu/libcyrus_min.so.0
/usr/lib/x86_64-linux-gnu/libcyrus_min.so.0.0.0
/usr/lib/x86_64-linux-gnu/libcyrus_sieve.so.0
/usr/lib/x86_64-linux-gnu/libcyrus_sieve.so.0.0.0
/usr/lib/x86_64-linux-gnu/libcyrus.so.0
/usr/lib/x86_64-linux-gnu/libcyrus.so.0.0.0
/usr/sbin/cyrdeliver
/usr/sbin/cyrmaster
/usr/sbin/cyrus
/usr/share/doc/cyrus-common/changelog.Debian.gz
/usr/share/doc/cyrus-common/changelog.gz
/usr/share/doc/cyrus-common/changelog.html.gz
/usr/share/doc/cyrus-common/copyright
/usr/share/doc/cyrus-common/README.configure-options
/usr/share/doc/cyrus-common/README.Debian.database.gz
/usr/share/doc/cyrus-common/README.Debian.debug.gz
/usr/share/doc/cyrus-common/README.Debian.gz
/usr/share/doc/cyrus-common/README.Debian.simpleinstall.gz
/usr/share/doc/cyrus-common/README.exim
/usr/share/doc/cyrus-common/README.new_upstream
/usr/share/doc/cyrus-common/README.postfix.gz
/usr/share/doc/cyrus-common/README.sendmail
/usr/share/lintian/overrides/cyrus-common
/usr/share/man/man5/cyrus.conf.5.gz
/usr/share/man/man5/imapd.conf.5.gz
/usr/share/man/man5/krb.equiv.5.gz
/usr/share/man/man8/ctl_backups.8.gz
/usr/share/man/man8/ctl_conversationsdb.8.gz
/usr/share/man/man8/cyr_backup.8.gz
/usr/share/man/man8/cyrus-arbitron.8.gz
/usr/share/man/man8/cyrus-arbitronsort.8.gz
/usr/share/man/man8/cyrus-backupd.8.gz
/usr/share/man/man8/cyrus-chk_cyrus.8.gz
/usr/share/man/man8/cyrus-ctl_cyrusdb.8.gz
/usr/share/man/man8/cyrus-ctl_deliver.8.gz
/usr/share/man/man8/cyrus-ctl_mboxlist.8.gz
/usr/share/man/man8/cyrus-ctl_zoneinfo.8.gz
/usr/share/man/man8/cyrus-cvt_cyrusdb.8.gz
/usr/share/man/man8/cyrus-cvt_xlist_specialuse.8.gz
/usr/share/man/man8/cyrus-cyr_buildinfo.8.gz
/usr/share/man/man8/cyrus-cyr_dbtool.8.gz
/usr/share/man/man8/cyrus-cyr_deny.8.gz
/usr/share/man/man8/cyrus-cyr_df.8.gz
/usr/share/man/man8/cyrus-cyrdump.8.gz
/usr/share/man/man8/cyrus-cyr_expire.8.gz
/usr/share/man/man8/cyrus-cyr_info.8.gz
/usr/share/man/man8/cyrus-cyr_ls.8.gz
/usr/share/man/man8/cyrus-cyr_userseen.8.gz
/usr/share/man/man8/cyrus-deliver.8.gz
/usr/share/man/man8/cyrus-dump.8.gz
/usr/share/man/man8/cyrus-fud.8.gz
/usr/share/man/man8/cyrus-ipurge.8.gz
/usr/share/man/man8/cyrus-lmtpd.8.gz
/usr/share/man/man8/cyrus-lmtpproxyd.8.gz
/usr/share/man/man8/cyrus-makedirs.8.gz
/usr/share/man/man8/cyrus-master.8.gz
/usr/share/man/man8/cyrus-mbexamine.8.gz
/usr/share/man/man8/cyrus-mbpath.8.gz
/usr/share/man/man8/cyrus-mbtool.8.gz
/usr/share/man/man8/cyrus-notifyd.8.gz
/usr/share/man/man8/cyrus-pop3proxyd.8.gz
/usr/share/man/man8/cyrus-proxyd.8.gz
/usr/share/man/man8/cyrus-ptdump.8.gz
/usr/share/man/man8/cyrus-ptexpire.8.gz
/usr/share/man/man8/cyrus-ptloader.8.gz
/usr/share/man/man8/cyrus-quota.8.gz
/usr/share/man/man8/cyrus-reconstruct.8.gz
/usr/share/man/man8/cyrus-relocate_by_id.8.gz
/usr/share/man/man8/cyrus-restore.8.gz
/usr/share/man/man8/cyrus-sievec.8.gz
/usr/share/man/man8/cyrus-sieved.8.gz
/usr/share/man/man8/cyrus-smmapd.8.gz
/usr/share/man/man8/cyrus-timsieved.8.gz
/usr/share/man/man8/cyrus-tls_prune.8.gz
/usr/share/man/man8/cyrus-unexpunge.8.gz
/usr/share/man/man8/cyr_virusscan.8.gz

Field source: Debian 12 (Bookworm) main amd64

Use this package

OpenFactory can boot this operating system in a browser VM, or start a build that includes the native package name from this record.

Try Debian 12 (Bookworm) in the browser Build an image that includes cyrus-common

Versions, suites, and repositories

Each row is recorded package-index metadata for one version, architecture, suite, and repository. Names, URLs, and sizes are source-reported; a link is a potentially mutable retrieval location, not an OpenFactory redistribution claim or proof that OpenFactory retained the artifact bytes.

Version	Release	Architecture	Repository	Package size	Installed size	Publisher repository artifact
3.6.1-4+deb12u4	bookworm / main	amd64	Debian 12 · main · amd64	1.3 MiB	5.5 MiB	pool/main/c/cyrus-imapd/cyrus-common_3.6.1-4+deb12u4_amd64.deb
3.6.1-4+deb12u4	bookworm / main	arm64	Debian 12 · main · arm64	1.2 MiB	7.5 MiB	pool/main/c/cyrus-imapd/cyrus-common_3.6.1-4+deb12u4_arm64.deb
3.10.1-3~bpo12+1	bookworm-backports / main	amd64	Debian 12 backports · main · amd64	1.4 MiB	5.9 MiB	pool/main/c/cyrus-imapd/cyrus-common_3.10.1-3~bpo12+1_amd64.deb
3.10.1-3~bpo12+1	bookworm-backports / main	arm64	Debian 12 backports · main · arm64	1.3 MiB	7.8 MiB	pool/main/c/cyrus-imapd/cyrus-common_3.10.1-3~bpo12+1_arm64.deb
3.6.1-4+deb12u2	bookworm-security / main	amd64	Debian 12 security · main · amd64	1.3 MiB	5.5 MiB	pool/updates/main/c/cyrus-imapd/cyrus-common_3.6.1-4+deb12u2_amd64.deb
3.6.1-4+deb12u2	bookworm-security / main	arm64	Debian 12 security · main · arm64	1.2 MiB	7.4 MiB	pool/updates/main/c/cyrus-imapd/cyrus-common_3.6.1-4+deb12u2_arm64.deb

Field source: Debian 12 (Bookworm) main amd64

Known vulnerabilities

Matching against OpenFactory catalog package versions is in progress.

CVE	Severity	Version impact
[CVE-2026-61915] Published: Sep 9, 2026, 8:18:36 PM UTC An issue was discovered in Cyrus IMAP before 3.12.4. There is a VPATCH BYPARAM double-free. An authenticated calendar user could crash a Cyrus CalDAV worker with a PATCH containing PATCH-ACTION="BYPAR	High(7.1)	Affected Details (6) `3.6.1-4+deb12u4` · amd64 · bookworm Affected nvd · cyrus-imapd · debian · bookworm; nvd · cyrus-imapd · debian · 12 `3.6.1-4+deb12u4` · arm64 · bookworm Affected nvd · cyrus-imapd · debian · bookworm; nvd · cyrus-imapd · debian · 12 `3.10.1-3~bpo12+1` · amd64 · bookworm-backports Affected nvd · cyrus-imapd · debian · bookworm; nvd · cyrus-imapd · debian · 12 `3.10.1-3~bpo12+1` · arm64 · bookworm-backports Affected nvd · cyrus-imapd · debian · bookworm; nvd · cyrus-imapd · debian · 12 `3.6.1-4+deb12u2` · amd64 · bookworm-security Affected nvd · cyrus-imapd · debian · bookworm; nvd · cyrus-imapd · debian · 12 `3.6.1-4+deb12u2` · arm64 · bookworm-security Affected nvd · cyrus-imapd · debian · bookworm; nvd · cyrus-imapd · debian · 12
[CVE-2026-61911] Published: Sep 9, 2026, 8:18:36 PM UTC An issue was discovered in Cyrus IMAP before 3.12.4. There is a Sieve mailbox existence oracle. An authenticated user could install a Sieve script that probed whether another user's private mailbox ex	Medium(4.3)	Affected Details (6) `3.6.1-4+deb12u4` · amd64 · bookworm Affected nvd · cyrus-imapd · debian · bookworm; nvd · cyrus-imapd · debian · 12 `3.6.1-4+deb12u4` · arm64 · bookworm Affected nvd · cyrus-imapd · debian · bookworm; nvd · cyrus-imapd · debian · 12 `3.10.1-3~bpo12+1` · amd64 · bookworm-backports Affected nvd · cyrus-imapd · debian · bookworm; nvd · cyrus-imapd · debian · 12 `3.10.1-3~bpo12+1` · arm64 · bookworm-backports Affected nvd · cyrus-imapd · debian · bookworm; nvd · cyrus-imapd · debian · 12 `3.6.1-4+deb12u2` · amd64 · bookworm-security Affected nvd · cyrus-imapd · debian · bookworm; nvd · cyrus-imapd · debian · 12 `3.6.1-4+deb12u2` · arm64 · bookworm-security Affected nvd · cyrus-imapd · debian · bookworm; nvd · cyrus-imapd · debian · 12
[CVE-2026-61910] Published: Sep 9, 2026, 8:18:36 PM UTC An issue was discovered in Cyrus IMAP before 3.12.4. Mailbox/set let a sharee change a special-use role on shared mailboxes. An authenticated user with maySetKeywords on another user's mailbox could c	Medium(5)	Affected Details (6) `3.6.1-4+deb12u4` · amd64 · bookworm Affected nvd · cyrus-imapd · debian · bookworm; nvd · cyrus-imapd · debian · 12 `3.6.1-4+deb12u4` · arm64 · bookworm Affected nvd · cyrus-imapd · debian · bookworm; nvd · cyrus-imapd · debian · 12 `3.10.1-3~bpo12+1` · amd64 · bookworm-backports Affected nvd · cyrus-imapd · debian · bookworm; nvd · cyrus-imapd · debian · 12 `3.10.1-3~bpo12+1` · arm64 · bookworm-backports Affected nvd · cyrus-imapd · debian · bookworm; nvd · cyrus-imapd · debian · 12 `3.6.1-4+deb12u2` · amd64 · bookworm-security Affected nvd · cyrus-imapd · debian · bookworm; nvd · cyrus-imapd · debian · 12 `3.6.1-4+deb12u2` · arm64 · bookworm-security Affected nvd · cyrus-imapd · debian · bookworm; nvd · cyrus-imapd · debian · 12
[CVE-2026-61909] Published: Sep 9, 2026, 8:18:36 PM UTC An issue was discovered in Cyrus IMAP before 3.12.4. CalDAV/CardDAV multiget bypasses a per-href ACL. An authenticated DAV user with some shared access to another user's calendar or address book could	Medium(5)	Affected Details (6) `3.6.1-4+deb12u4` · amd64 · bookworm Affected nvd · cyrus-imapd · debian · bookworm; nvd · cyrus-imapd · debian · 12 `3.6.1-4+deb12u4` · arm64 · bookworm Affected nvd · cyrus-imapd · debian · bookworm; nvd · cyrus-imapd · debian · 12 `3.10.1-3~bpo12+1` · amd64 · bookworm-backports Affected nvd · cyrus-imapd · debian · bookworm; nvd · cyrus-imapd · debian · 12 `3.10.1-3~bpo12+1` · arm64 · bookworm-backports Affected nvd · cyrus-imapd · debian · bookworm; nvd · cyrus-imapd · debian · 12 `3.6.1-4+deb12u2` · amd64 · bookworm-security Affected nvd · cyrus-imapd · debian · bookworm; nvd · cyrus-imapd · debian · 12 `3.6.1-4+deb12u2` · arm64 · bookworm-security Affected nvd · cyrus-imapd · debian · bookworm; nvd · cyrus-imapd · debian · 12
[CVE-2026-61908] Published: Sep 9, 2026, 8:18:36 PM UTC An issue was discovered in Cyrus IMAP before 3.12.4. A JMAP email-header blob ID can reference an out-of-bounds index. An authenticated user could attempt to download a crafted JMAP blob ID of the for	Medium(6.5)	Affected Details (6) `3.6.1-4+deb12u4` · amd64 · bookworm Affected nvd · cyrus-imapd · debian · bookworm; nvd · cyrus-imapd · debian · 12 `3.6.1-4+deb12u4` · arm64 · bookworm Affected nvd · cyrus-imapd · debian · bookworm; nvd · cyrus-imapd · debian · 12 `3.10.1-3~bpo12+1` · amd64 · bookworm-backports Affected nvd · cyrus-imapd · debian · bookworm; nvd · cyrus-imapd · debian · 12 `3.10.1-3~bpo12+1` · arm64 · bookworm-backports Affected nvd · cyrus-imapd · debian · bookworm; nvd · cyrus-imapd · debian · 12 `3.6.1-4+deb12u2` · amd64 · bookworm-security Affected nvd · cyrus-imapd · debian · bookworm; nvd · cyrus-imapd · debian · 12 `3.6.1-4+deb12u2` · arm64 · bookworm-security Affected nvd · cyrus-imapd · debian · bookworm; nvd · cyrus-imapd · debian · 12
[CVE-2026-61907] Published: Sep 9, 2026, 8:02:56 AM UTC An issue was discovered in Cyrus IMAP before 3.12.4. JMAP snooze bypasses the destination-mailbox ACL. An authenticated user with insert permissions on another user's snoozed mailbox could cause inser	Medium(4.3)	Affected Details (6) `3.6.1-4+deb12u4` · amd64 · bookworm Affected nvd · cyrus-imapd · debian · bookworm; nvd · cyrus-imapd · debian · 12 `3.6.1-4+deb12u4` · arm64 · bookworm Affected nvd · cyrus-imapd · debian · bookworm; nvd · cyrus-imapd · debian · 12 `3.10.1-3~bpo12+1` · amd64 · bookworm-backports Affected nvd · cyrus-imapd · debian · bookworm; nvd · cyrus-imapd · debian · 12 `3.10.1-3~bpo12+1` · arm64 · bookworm-backports Affected nvd · cyrus-imapd · debian · bookworm; nvd · cyrus-imapd · debian · 12 `3.6.1-4+deb12u2` · amd64 · bookworm-security Affected nvd · cyrus-imapd · debian · bookworm; nvd · cyrus-imapd · debian · 12 `3.6.1-4+deb12u2` · arm64 · bookworm-security Affected nvd · cyrus-imapd · debian · bookworm; nvd · cyrus-imapd · debian · 12
[CVE-2026-47081] Published: Jul 16, 2026, 12:00:00 AM UTC An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. There is an XAPPLEPUSHSERVICE folder existence oracle and push hijack. An authenticated IMAP user could probe for the existence of	Low(3.1)	Affected Details (6) `3.6.1-4+deb12u4` · amd64 · bookworm Affected · Fixed: `3.6.1-4+deb12u5` nvd · cyrus-imapd · debian · bookworm; nvd · cyrus-imapd · debian · 12 `3.6.1-4+deb12u4` · arm64 · bookworm Affected · Fixed: `3.6.1-4+deb12u5` nvd · cyrus-imapd · debian · bookworm; nvd · cyrus-imapd · debian · 12 `3.10.1-3~bpo12+1` · amd64 · bookworm-backports Fixed · Fixed: `3.6.1-4+deb12u5` nvd · cyrus-imapd · debian · bookworm; nvd · cyrus-imapd · debian · 12 `3.10.1-3~bpo12+1` · arm64 · bookworm-backports Fixed · Fixed: `3.6.1-4+deb12u5` nvd · cyrus-imapd · debian · bookworm; nvd · cyrus-imapd · debian · 12 `3.6.1-4+deb12u2` · amd64 · bookworm-security Affected · Fixed: `3.6.1-4+deb12u5` nvd · cyrus-imapd · debian · bookworm; nvd · cyrus-imapd · debian · 12 `3.6.1-4+deb12u2` · arm64 · bookworm-security Affected · Fixed: `3.6.1-4+deb12u5` nvd · cyrus-imapd · debian · bookworm; nvd · cyrus-imapd · debian · 12
[CVE-2026-47082] Published: Jul 16, 2026, 12:00:00 AM UTC An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. The vacation "fcc" feature skips the destination-mailbox ACL. A user whose vacation Sieve script used :fcc (to save a copy of the s	Medium(5.4)	Affected Details (6) `3.6.1-4+deb12u4` · amd64 · bookworm Affected · Fixed: `3.6.1-4+deb12u5` nvd · cyrus-imapd · debian · bookworm; nvd · cyrus-imapd · debian · 12 `3.6.1-4+deb12u4` · arm64 · bookworm Affected · Fixed: `3.6.1-4+deb12u5` nvd · cyrus-imapd · debian · bookworm; nvd · cyrus-imapd · debian · 12 `3.10.1-3~bpo12+1` · amd64 · bookworm-backports Fixed · Fixed: `3.6.1-4+deb12u5` nvd · cyrus-imapd · debian · bookworm; nvd · cyrus-imapd · debian · 12 `3.10.1-3~bpo12+1` · arm64 · bookworm-backports Fixed · Fixed: `3.6.1-4+deb12u5` nvd · cyrus-imapd · debian · bookworm; nvd · cyrus-imapd · debian · 12 `3.6.1-4+deb12u2` · amd64 · bookworm-security Affected · Fixed: `3.6.1-4+deb12u5` nvd · cyrus-imapd · debian · bookworm; nvd · cyrus-imapd · debian · 12 `3.6.1-4+deb12u2` · arm64 · bookworm-security Affected · Fixed: `3.6.1-4+deb12u5` nvd · cyrus-imapd · debian · bookworm; nvd · cyrus-imapd · debian · 12
[CVE-2026-47083] Published: Jul 16, 2026, 12:00:00 AM UTC An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. There is an ESEARCH cross-user content oracle. By using the ESEARCH command, an authenticated IMAP user could enumerate folder name	Medium(4.3)	Affected Details (6) `3.6.1-4+deb12u4` · amd64 · bookworm Affected nvd · cyrus-imapd · debian · bookworm; nvd · cyrus-imapd · debian · 12 `3.6.1-4+deb12u4` · arm64 · bookworm Affected nvd · cyrus-imapd · debian · bookworm; nvd · cyrus-imapd · debian · 12 `3.10.1-3~bpo12+1` · amd64 · bookworm-backports Affected nvd · cyrus-imapd · debian · bookworm; nvd · cyrus-imapd · debian · 12 `3.10.1-3~bpo12+1` · arm64 · bookworm-backports Affected nvd · cyrus-imapd · debian · bookworm; nvd · cyrus-imapd · debian · 12 `3.6.1-4+deb12u2` · amd64 · bookworm-security Affected nvd · cyrus-imapd · debian · bookworm; nvd · cyrus-imapd · debian · 12 `3.6.1-4+deb12u2` · arm64 · bookworm-security Affected nvd · cyrus-imapd · debian · bookworm; nvd · cyrus-imapd · debian · 12
[CVE-2026-47084] Published: Jul 16, 2026, 12:00:00 AM UTC An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. The LOCALDELETE command bypassed ACL checks. An authenticated but non-admin user could invoke the admin-only LOCALDELETE IMAP comma	Medium(6.5)	Affected Details (6) `3.6.1-4+deb12u4` · amd64 · bookworm Affected · Fixed: `3.6.1-4+deb12u5` nvd · cyrus-imapd · debian · bookworm; nvd · cyrus-imapd · debian · 12 `3.6.1-4+deb12u4` · arm64 · bookworm Affected · Fixed: `3.6.1-4+deb12u5` nvd · cyrus-imapd · debian · bookworm; nvd · cyrus-imapd · debian · 12 `3.10.1-3~bpo12+1` · amd64 · bookworm-backports Fixed · Fixed: `3.6.1-4+deb12u5` nvd · cyrus-imapd · debian · bookworm; nvd · cyrus-imapd · debian · 12 `3.10.1-3~bpo12+1` · arm64 · bookworm-backports Fixed · Fixed: `3.6.1-4+deb12u5` nvd · cyrus-imapd · debian · bookworm; nvd · cyrus-imapd · debian · 12 `3.6.1-4+deb12u2` · amd64 · bookworm-security Affected · Fixed: `3.6.1-4+deb12u5` nvd · cyrus-imapd · debian · bookworm; nvd · cyrus-imapd · debian · 12 `3.6.1-4+deb12u2` · arm64 · bookworm-security Affected · Fixed: `3.6.1-4+deb12u5` nvd · cyrus-imapd · debian · bookworm; nvd · cyrus-imapd · debian · 12
[CVE-2026-47085] Published: Jul 16, 2026, 12:00:00 AM UTC An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. URLAUTH token forgery can occur via a missing mboxkey. If an attacker knew a folder name on the victim's account for which the vict	Medium(4)	Affected Details (6) `3.6.1-4+deb12u4` · amd64 · bookworm Affected · Fixed: `3.6.1-4+deb12u5` nvd · cyrus-imapd · debian · bookworm; nvd · cyrus-imapd · debian · 12 `3.6.1-4+deb12u4` · arm64 · bookworm Affected · Fixed: `3.6.1-4+deb12u5` nvd · cyrus-imapd · debian · bookworm; nvd · cyrus-imapd · debian · 12 `3.10.1-3~bpo12+1` · amd64 · bookworm-backports Fixed · Fixed: `3.6.1-4+deb12u5` nvd · cyrus-imapd · debian · bookworm; nvd · cyrus-imapd · debian · 12 `3.10.1-3~bpo12+1` · arm64 · bookworm-backports Fixed · Fixed: `3.6.1-4+deb12u5` nvd · cyrus-imapd · debian · bookworm; nvd · cyrus-imapd · debian · 12 `3.6.1-4+deb12u2` · amd64 · bookworm-security Affected · Fixed: `3.6.1-4+deb12u5` nvd · cyrus-imapd · debian · bookworm; nvd · cyrus-imapd · debian · 12 `3.6.1-4+deb12u2` · arm64 · bookworm-security Affected · Fixed: `3.6.1-4+deb12u5` nvd · cyrus-imapd · debian · bookworm; nvd · cyrus-imapd · debian · 12
[CVE-2026-47086] Published: Jul 16, 2026, 12:00:00 AM UTC An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. GENURLAUTH-issued tokens can bypass ACLs. Any authenticated user could mint a URLAUTH token (via the GENURLAUTH command) for any ma	Medium(4.3)	Affected Details (6) `3.6.1-4+deb12u4` · amd64 · bookworm Affected · Fixed: `3.6.1-4+deb12u5` nvd · cyrus-imapd · debian · bookworm; nvd · cyrus-imapd · debian · 12 `3.6.1-4+deb12u4` · arm64 · bookworm Affected · Fixed: `3.6.1-4+deb12u5` nvd · cyrus-imapd · debian · bookworm; nvd · cyrus-imapd · debian · 12 `3.10.1-3~bpo12+1` · amd64 · bookworm-backports Fixed · Fixed: `3.6.1-4+deb12u5` nvd · cyrus-imapd · debian · bookworm; nvd · cyrus-imapd · debian · 12 `3.10.1-3~bpo12+1` · arm64 · bookworm-backports Fixed · Fixed: `3.6.1-4+deb12u5` nvd · cyrus-imapd · debian · bookworm; nvd · cyrus-imapd · debian · 12 `3.6.1-4+deb12u2` · amd64 · bookworm-security Affected · Fixed: `3.6.1-4+deb12u5` nvd · cyrus-imapd · debian · bookworm; nvd · cyrus-imapd · debian · 12 `3.6.1-4+deb12u2` · arm64 · bookworm-security Affected · Fixed: `3.6.1-4+deb12u5` nvd · cyrus-imapd · debian · bookworm; nvd · cyrus-imapd · debian · 12
[CVE-2026-47087] Published: Jul 16, 2026, 12:00:00 AM UTC An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. URLAUTH does not honor revoked authorizer access. A URLAUTH URL minted while the authorizer had access continued to work after that	Low(3.5)	Affected Details (6) `3.6.1-4+deb12u4` · amd64 · bookworm Affected · Fixed: `3.6.1-4+deb12u5` nvd · cyrus-imapd · debian · bookworm; nvd · cyrus-imapd · debian · 12 `3.6.1-4+deb12u4` · arm64 · bookworm Affected · Fixed: `3.6.1-4+deb12u5` nvd · cyrus-imapd · debian · bookworm; nvd · cyrus-imapd · debian · 12 `3.10.1-3~bpo12+1` · amd64 · bookworm-backports Fixed · Fixed: `3.6.1-4+deb12u5` nvd · cyrus-imapd · debian · bookworm; nvd · cyrus-imapd · debian · 12 `3.10.1-3~bpo12+1` · arm64 · bookworm-backports Fixed · Fixed: `3.6.1-4+deb12u5` nvd · cyrus-imapd · debian · bookworm; nvd · cyrus-imapd · debian · 12 `3.6.1-4+deb12u2` · amd64 · bookworm-security Affected · Fixed: `3.6.1-4+deb12u5` nvd · cyrus-imapd · debian · bookworm; nvd · cyrus-imapd · debian · 12 `3.6.1-4+deb12u2` · arm64 · bookworm-security Affected · Fixed: `3.6.1-4+deb12u5` nvd · cyrus-imapd · debian · bookworm; nvd · cyrus-imapd · debian · 12
[CVE-2026-47088] Published: Jul 16, 2026, 12:00:00 AM UTC An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. There is heap exposure in nested MIME comment parsing. An authenticated IMAP user could craft an email message containing an RFC 82	Low(3.1)	Affected Details (6) `3.6.1-4+deb12u4` · amd64 · bookworm Affected · Fixed: `3.6.1-4+deb12u5` nvd · cyrus-imapd · debian · bookworm; nvd · cyrus-imapd · debian · 12 `3.6.1-4+deb12u4` · arm64 · bookworm Affected · Fixed: `3.6.1-4+deb12u5` nvd · cyrus-imapd · debian · bookworm; nvd · cyrus-imapd · debian · 12 `3.10.1-3~bpo12+1` · amd64 · bookworm-backports Fixed · Fixed: `3.6.1-4+deb12u5` nvd · cyrus-imapd · debian · bookworm; nvd · cyrus-imapd · debian · 12 `3.10.1-3~bpo12+1` · arm64 · bookworm-backports Fixed · Fixed: `3.6.1-4+deb12u5` nvd · cyrus-imapd · debian · bookworm; nvd · cyrus-imapd · debian · 12 `3.6.1-4+deb12u2` · amd64 · bookworm-security Affected · Fixed: `3.6.1-4+deb12u5` nvd · cyrus-imapd · debian · bookworm; nvd · cyrus-imapd · debian · 12 `3.6.1-4+deb12u2` · arm64 · bookworm-security Affected · Fixed: `3.6.1-4+deb12u5` nvd · cyrus-imapd · debian · bookworm; nvd · cyrus-imapd · debian · 12
[CVE-2026-47089] Published: Jul 16, 2026, 12:00:00 AM UTC An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. LISTRIGHTS os not limited to users with admin access. An authenticated user could call IMAP LISTRIGHTS against any mailbox they cou	Medium(4.3)	Affected Details (6) `3.6.1-4+deb12u4` · amd64 · bookworm Affected · Fixed: `3.6.1-4+deb12u5` nvd · cyrus-imapd · debian · bookworm; nvd · cyrus-imapd · debian · 12 `3.6.1-4+deb12u4` · arm64 · bookworm Affected · Fixed: `3.6.1-4+deb12u5` nvd · cyrus-imapd · debian · bookworm; nvd · cyrus-imapd · debian · 12 `3.10.1-3~bpo12+1` · amd64 · bookworm-backports Fixed · Fixed: `3.6.1-4+deb12u5` nvd · cyrus-imapd · debian · bookworm; nvd · cyrus-imapd · debian · 12 `3.10.1-3~bpo12+1` · arm64 · bookworm-backports Fixed · Fixed: `3.6.1-4+deb12u5` nvd · cyrus-imapd · debian · bookworm; nvd · cyrus-imapd · debian · 12 `3.6.1-4+deb12u2` · amd64 · bookworm-security Affected · Fixed: `3.6.1-4+deb12u5` nvd · cyrus-imapd · debian · bookworm; nvd · cyrus-imapd · debian · 12 `3.6.1-4+deb12u2` · arm64 · bookworm-security Affected · Fixed: `3.6.1-4+deb12u5` nvd · cyrus-imapd · debian · bookworm; nvd · cyrus-imapd · debian · 12

Fixed and unaffected versions (5)

CVE	Severity	Version impact
[CVE-2025-23394] Published: Apr 29, 2025, 12:00:00 AM UTC cyrus-imapd: CVE-2025-23394	Low	Not affected Details (6) `3.6.1-4+deb12u4` · amd64 · bookworm Not affected dsa · cyrus-imapd · debian · bookworm `3.6.1-4+deb12u4` · arm64 · bookworm Not affected dsa · cyrus-imapd · debian · bookworm `3.10.1-3~bpo12+1` · amd64 · bookworm-backports Not affected dsa · cyrus-imapd · debian · bookworm `3.10.1-3~bpo12+1` · arm64 · bookworm-backports Not affected dsa · cyrus-imapd · debian · bookworm `3.6.1-4+deb12u2` · amd64 · bookworm-security Not affected dsa · cyrus-imapd · debian · bookworm `3.6.1-4+deb12u2` · arm64 · bookworm-security Not affected dsa · cyrus-imapd · debian · bookworm
[CVE-2024-34055] Published: Jun 4, 2024, 10:00:00 PM UTC Cyrus IMAP Server vulnerabilities	Medium(6.5)	Fixed Details (6) `3.6.1-4+deb12u4` · amd64 · bookworm Fixed · Fixed: `3.6.1-4+deb12u2` usn · cyrus-imapd · debian · bookworm; usn · cyrus-imapd · debian · 12 `3.6.1-4+deb12u4` · arm64 · bookworm Fixed · Fixed: `3.6.1-4+deb12u2` usn · cyrus-imapd · debian · bookworm; usn · cyrus-imapd · debian · 12 `3.10.1-3~bpo12+1` · amd64 · bookworm-backports Fixed · Fixed: `3.6.1-4+deb12u2` usn · cyrus-imapd · debian · bookworm; usn · cyrus-imapd · debian · 12 `3.10.1-3~bpo12+1` · arm64 · bookworm-backports Fixed · Fixed: `3.6.1-4+deb12u2` usn · cyrus-imapd · debian · bookworm; usn · cyrus-imapd · debian · 12 `3.6.1-4+deb12u2` · amd64 · bookworm-security Fixed · Fixed: `3.6.1-4+deb12u2` usn · cyrus-imapd · debian · bookworm; usn · cyrus-imapd · debian · 12 `3.6.1-4+deb12u2` · arm64 · bookworm-security Fixed · Fixed: `3.6.1-4+deb12u2` usn · cyrus-imapd · debian · bookworm; usn · cyrus-imapd · debian · 12
[CVE-2021-33582] Published: Aug 31, 2021, 10:00:00 PM UTC Cyrus IMAP Server vulnerabilities	High(7.5)	Fixed Details (6) `3.6.1-4+deb12u4` · amd64 · bookworm Fixed · Fixed: `3.4.2-1` usn · cyrus-imapd · debian · bookworm; usn · cyrus-imapd · debian · 12 `3.6.1-4+deb12u4` · arm64 · bookworm Fixed · Fixed: `3.4.2-1` usn · cyrus-imapd · debian · bookworm; usn · cyrus-imapd · debian · 12 `3.10.1-3~bpo12+1` · amd64 · bookworm-backports Fixed · Fixed: `3.4.2-1` usn · cyrus-imapd · debian · bookworm; usn · cyrus-imapd · debian · 12 `3.10.1-3~bpo12+1` · arm64 · bookworm-backports Fixed · Fixed: `3.4.2-1` usn · cyrus-imapd · debian · bookworm; usn · cyrus-imapd · debian · 12 `3.6.1-4+deb12u2` · amd64 · bookworm-security Fixed · Fixed: `3.4.2-1` usn · cyrus-imapd · debian · bookworm; usn · cyrus-imapd · debian · 12 `3.6.1-4+deb12u2` · arm64 · bookworm-security Fixed · Fixed: `3.4.2-1` usn · cyrus-imapd · debian · bookworm; usn · cyrus-imapd · debian · 12
[CVE-2021-32056] Published: May 10, 2021, 2:15:00 PM UTC cyrus-imapd: CVE-2021-32056	Medium	Fixed Details (6) `3.6.1-4+deb12u4` · amd64 · bookworm Fixed · Fixed: `3.2.6-2` dsa · cyrus-imapd · debian · bookworm; dsa · cyrus-imapd · debian · 12 `3.6.1-4+deb12u4` · arm64 · bookworm Fixed · Fixed: `3.2.6-2` dsa · cyrus-imapd · debian · bookworm; dsa · cyrus-imapd · debian · 12 `3.10.1-3~bpo12+1` · amd64 · bookworm-backports Fixed · Fixed: `3.2.6-2` dsa · cyrus-imapd · debian · bookworm; dsa · cyrus-imapd · debian · 12 `3.10.1-3~bpo12+1` · arm64 · bookworm-backports Fixed · Fixed: `3.2.6-2` dsa · cyrus-imapd · debian · bookworm; dsa · cyrus-imapd · debian · 12 `3.6.1-4+deb12u2` · amd64 · bookworm-security Fixed · Fixed: `3.2.6-2` dsa · cyrus-imapd · debian · bookworm; dsa · cyrus-imapd · debian · 12 `3.6.1-4+deb12u2` · arm64 · bookworm-security Fixed · Fixed: `3.2.6-2` dsa · cyrus-imapd · debian · bookworm; dsa · cyrus-imapd · debian · 12
[CVE-2019-19783] Published: Dec 16, 2019, 2:15:00 PM UTC cyrus-imapd: CVE-2019-19783	Medium(6.5)	Fixed Details (6) `3.6.1-4+deb12u4` · amd64 · bookworm Fixed · Fixed: `3.0.13-1` dsa · cyrus-imapd · debian · bookworm; dsa · cyrus-imapd · debian · 12 `3.6.1-4+deb12u4` · arm64 · bookworm Fixed · Fixed: `3.0.13-1` dsa · cyrus-imapd · debian · bookworm; dsa · cyrus-imapd · debian · 12 `3.10.1-3~bpo12+1` · amd64 · bookworm-backports Fixed · Fixed: `3.0.13-1` dsa · cyrus-imapd · debian · bookworm; dsa · cyrus-imapd · debian · 12 `3.10.1-3~bpo12+1` · arm64 · bookworm-backports Fixed · Fixed: `3.0.13-1` dsa · cyrus-imapd · debian · bookworm; dsa · cyrus-imapd · debian · 12 `3.6.1-4+deb12u2` · amd64 · bookworm-security Fixed · Fixed: `3.0.13-1` dsa · cyrus-imapd · debian · bookworm; dsa · cyrus-imapd · debian · 12 `3.6.1-4+deb12u2` · arm64 · bookworm-security Fixed · Fixed: `3.0.13-1` dsa · cyrus-imapd · debian · bookworm; dsa · cyrus-imapd · debian · 12

[Next results]

Last synced: Oct 28, 2026, 3:52:27 AM UTC

[CVE catalog]

Checksums

Repository signatures authenticate metadata. Artifact hashing is recorded separately. Neither establishes package safety.

3.6.1-4+deb12u4 / amd64Observed Sep 1, 2026sha256 24b060a803cb…3be6a5f4Source-reported digest