{"affected":[{"ecosystem_specific":{"binaries":[{"cyrus-imapd-devel":"2.3.11-60.65.67.1","perl-Cyrus-IMAP":"2.3.11-60.65.67.1","perl-Cyrus-SIEVE-managesieve":"2.3.11-60.65.67.1"}]},"package":{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 11 SP4","name":"cyrus-imapd","purl":"pkg:rpm/suse/cyrus-imapd&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2011%20SP4"},"ranges":[{"events":[{"introduced":"0"},{"fixed":"2.3.11-60.65.67.1"}],"type":"ECOSYSTEM"}]},{"ecosystem_specific":{"binaries":[{"cyrus-imapd":"2.3.11-60.65.67.1","perl-Cyrus-IMAP":"2.3.11-60.65.67.1","perl-Cyrus-SIEVE-managesieve":"2.3.11-60.65.67.1"}]},"package":{"ecosystem":"SUSE:Linux Enterprise Server 11 SP4","name":"cyrus-imapd","purl":"pkg:rpm/suse/cyrus-imapd&distro=SUSE%20Linux%20Enterprise%20Server%2011%20SP4"},"ranges":[{"events":[{"introduced":"0"},{"fixed":"2.3.11-60.65.67.1"}],"type":"ECOSYSTEM"}]},{"ecosystem_specific":{"binaries":[{"cyrus-imapd":"2.3.11-60.65.67.1","perl-Cyrus-IMAP":"2.3.11-60.65.67.1","perl-Cyrus-SIEVE-managesieve":"2.3.11-60.65.67.1"}]},"package":{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","name":"cyrus-imapd","purl":"pkg:rpm/suse/cyrus-imapd&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2011%20SP4"},"ranges":[{"events":[{"introduced":"0"},{"fixed":"2.3.11-60.65.67.1"}],"type":"ECOSYSTEM"}]}],"aliases":[],"details":"\nThis update for cyrus-imapd fixes the following issues:\n\n- Previous versions of cyrus-imapd would not allow its users to disable old SSL\n  variants that are vulnerable to attacks like BEAST and POODLE. This patch\n  adds the configuration option 'tls_versions' to remedy that issue. Note that\n  users who upgrade an existing installation will *not* have their imapd.conf\n  file overwritten, i.e. their IMAP server will continue to support SSLv2 and\n  SSLv3 like before. To disable support for those protocols, edit imapd.conf\n  manually to include 'tls_versions: tls1_0 tls1_1 tls1_2'. New installations,\n  however, will have an imapd.conf file that contains these settings already,\n  i.e. newly installed IMAP servers do *not* support unsafe versions of SSL\n  unless that support is explicitly enabled by the user. (bsc#901748)\n\n- An integer overflow vulnerability in cyrus-imapd's urlfetch range checking\n  code was fixed. (CVE-2015-8076, CVE-2015-8077, CVE-2015-8078, bsc#981670,\n  bsc#954200, bsc#954201)\n\n- Support for Elliptic Curve Diffie–Hellman (ECDH) has been added to\n  cyrus-imapd. (bsc#860611)\n","id":"SUSE-SU-2016:1459-1","modified":"2016-06-01T07:00:34Z","published":"2016-06-01T07:00:34Z","references":[{"type":"ADVISORY","url":"https://www.suse.com/support/update/announcement/2016/suse-su-20161459-1/"},{"type":"REPORT","url":"https://bugzilla.suse.com/860611"},{"type":"REPORT","url":"https://bugzilla.suse.com/901748"},{"type":"REPORT","url":"https://bugzilla.suse.com/954200"},{"type":"REPORT","url":"https://bugzilla.suse.com/954201"},{"type":"REPORT","url":"https://bugzilla.suse.com/981670"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2014-3566"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2015-8076"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2015-8077"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2015-8078"}],"related":["CVE-2014-3566","CVE-2015-8076","CVE-2015-8077","CVE-2015-8078"],"summary":"Security update for cyrus-imapd","upstream":["CVE-2014-3566","CVE-2015-8076","CVE-2015-8077","CVE-2015-8078"]}