BSD Ports

Vulnerable: version 3.10.2nb2 is affected by 6 known vulnerabilities. See below.

mail/cyrus-imapd310 3.10.2nb2 NetBSD

Cyrus IMAP server

System
NetBSD
Repository
pkgsrc
Maintainer
[email protected]
Last update
Commit
e0d337b83b
License
original-bsd
Categories
mail
Package size
1564.2 KiB, 11565.4 KiB installed

Description

IMAP (Internet Message Access Protocol) is an Internet standards-track protocol for accessing messages (mail, bboards, news, etc). The Cyrus IMAP server differs from other IMAP server implementations in that it is generally intended to be run on "sealed" servers, where normal users are not permitted to log in. The mailbox database is stored in parts of the filesystem that are private to the Cyrus IMAP system. All user access to mail is through the IMAP, POP3, or KPOP protocols.

In the other systems

SystemPortVersion
NetBSDmail/cyrus-imapd3103.10.2nb2
FreeBSDmail/cyrus-imapd3103.10.4
OpenBSDmail/cyrus-imapd3.13.7
HardenedBSDmail/cyrus-imapd3103.10.4
GhostBSDmail/cyrus-imapd3103.10.4

Install

Binary package:

pkgin install cyrus-imapd

From pkgsrc:

cd /usr/pkgsrc/mail/cyrus-imapd310 && make install clean

Packages

The version each package repository carries. “-” means the repository builds no package of it, “n/a” that there is no such repository.

RepositoryVersion
NetBSD 10.1 x86_643.10.2nb2
NetBSD 10.1 aarch643.10.2
SmartOS / illumos x86_64-
macOS 15 arm64-

Dependencies

Run dependencies 8

No port depends on this one.

Known vulnerabilities 6

Commit history 3

DateCommitCreditsLog message
e0d337b83b jnemeth Update to Cyrus IMAPd 3.10.4.
Cyrus IMAP 3.10.4 Release Notes Changes since 3.10.3 Security fixes * CVE-2026-61907: JMAP snooze bypasses destination-mailbox ACL An authenticated user with insert permissions on another user's snoozed mailbox could cause insertion of mail to that user's inbox, or any other of their mailboxes whose id was known to the user, despite having no insert permissions to the target mailbox. Reported by: Michael Lynch (mtlynch.io). * CVE-2026-61908: JMAP email-header blob ID out-of-bounds index An authenticated user could attempt to download a specially crafted JMAP blob ID of the form H<emailid>-<index>, which could read past the end of the internal blob_headers array during download, exposing adjacent heap memory. …
33e768c17a mef (mail/cyrus-imapd310) Fix patch-configure failing
618415630a wiz *: recursive bump for perl5 5.44.0