{
  "cveId": "CVE-2025-23394",
  "url": "https://patchblox.com/security/cve/CVE-2025-23394",
  "summary": "CVE-2025-23394 is fixed in cyrus-imapd on 1 platform by OPENSUSE-SU-2026:20962-1 (version 3.8.6-bp160.1.1), released June 12, 2026. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "cyrus-imapd: This update for cyrus-imapd fixes the following issues:\n\nChanges in cyrus-imapd:\n\n- cyrus-imapd don\u0027t start because o...",
  "description": "This update for cyrus-imapd fixes the following issues:\n\nChanges in cyrus-imapd:\n\n- cyrus-imapd don\u0027t start because of missing \u0022Requires=var-run.mount\u0022 from systemd (bsc#1251788)\n  Remove var-run.mount from Requires and After\n\n- update to version 3.8.6 (bugfix release)\n  VUL-0: CVE-2025-49812: cyrus-imapd: Opossum Attack Application Layer\n  Desynchronization using Opportunistic TLS (bsc#1246165)\n  The industry is deprecating STARTTLS (aka opportunistic TLS) in favor of\n  implicit TLS over a dedicated port.  STARTTLS is now disabled by default.\n  * Fixed issue #5477: master: tighten up pidfile/etc handling (bsc#1241543)\n    VUL-0: cyrus-imapd: privilege drop happens too late, opening attack vectors from cyrus to root\n  * Fixed issue #5450: fix zoneinfo_db code for GCC 15 (thanks Yadd)\n  * Fixed issue #5309: deadlock on shutdown (thanks Mark Cammidge)\n  * Fixed issue #5424: recognise service-specific SASL options in\n    \u0060\u0060cyr_info conf-lint\u0060\u0060\n  * Fixed issue #5420: fix double-free in http_admin (thanks Wolfgang Breyha)\n  * Fixed issue #5460: pop3d: add basic prometheus support (thanks Wolfgang\n    Breyha)\n  * Fixed issue #5454: httpd fails to parse OpenSSL version for status string\n\n- update to version 3.8.5 (bugfix release)\n  * Fixed Issue #5029: check for unexpected extra tiny-tests directories\n  * Fixed Issue #5148: added --enable-release-checks configure option for use when building releases\n  * Fixed Issue #4489: calendar-color \u0022changes\u0022 namespace (thanks \u0414\u0438\u043B\u044F\u043D \u041F\u0430\u043B\u0430\u0443\u0437\u043E\u0432)\n  * Fixed Issue #5009: various portability warnings and nits\n  * Fixed Issue #5050: iTIP line endings (thanks \u0414\u0438\u043B\u044F\u043D \u041F\u0430\u043B\u0430\u0443\u0437\u043E\u0432)\n  * Fixed Issue #5052: iMIP line endings (thanks \u0414\u0438\u043B\u044F\u043D \u041F\u0430\u043B\u0430\u0443\u0437\u043E\u0432)\n  * Fixed Issue #5072: http_cgi use after free (thanks \u0414\u0438\u043B\u044F\u043D \u041F\u0430\u043B\u0430\u0443\u0437\u043E\u0432)\n  * Fixed Issue #5094: httpd crash when PROPFIND url is /dav/calendars\n  * Fixed Issue #5118: broken language checks for \u0022zr-hant\u0022 and \u0022sr-me\u0022\n  * Fixed Issue #5047: proxying UID SEARCH\n\n- CVE-2025-23394: cyrus-imapd: daily-backup.sh allows escalation from cyrus to root (bsc#1241536)",
  "published": "2026-06-12T18:46:10Z",
  "severity": "",
  "epss": 0.00599,
  "epssPercentile": 0.48944,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "cyrus-imapd",
      "release": "opensuse-leap 16.0",
      "fixedVersion": "3.8.6-bp160.1.1",
      "fix": "OPENSUSE-SU-2026:20962-1",
      "url": "https://patchblox.com/security/fix/linux/opensuse-su-2026-20962-1",
      "released": "2026-06-12T18:46:10Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-10T07:50:38Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}