Threats affecting pkg:rpm/suse/cyrus-imapd

This update for cyrus-imapd fixes the following issues: Changes in cyrus-imapd: - Update to 3.8.7 (bugfix release) - CVE-2026-47081: XAPPLEPUSHSERVICE folder existence oracle and push hijack (bsc#1271617) - CVE-2026-47083: ESEARCH cross-user content oracle (bsc#1271619) - CVE-2026-47082: Vacation "fcc" skips destination-mailbox ACL (bsc#1271618) - CVE-2026-47084: LOCALDELETE bypassed ACL checks (bsc#1271620) - CVE-2026-47085: URLAUTH token forgery via missing mboxkey (bsc#1271621) - CVE-2026-47086: GENURLAUTH issued tokens bypassing ACLs (bsc#1271622) - CVE-2026-47087: URLAUTH does not honor revoked authorizer access (bsc#1271623) - CVE-2026-47088: Heap exposure in nested MIME comment parsing (bsc#1271624) - CVE-2026-47089: LISTRIGHTS not limited to users with admin access (bsc#1271625)

This security update for cyrus-imapd addresses multiple issues including two notable vulnerabilities: CVE-2025-49812 related to Opportunistic TLS desynchronization attacks and CVE-2025-23394 which allows privilege escalation from the cyrus user to root via the daily-backup.sh script. The update also disables STARTTLS by default in favor of implicit TLS over a dedicated port and fixes several bugs and stability issues.