CVSS: 7.5EPSS: 26%CPEs: 40EXPL: 0CVE-2011-3208 – cyrus-imapd: nntpd buffer overflow in split_wildmats()
https://notcve.org/view.php?id=CVE-2011-3208
Stack-based buffer overflow in the split_wildmats function in nntpd.c in nntpd in Cyrus IMAP Server before 2.3.17 and 2.4.x before 2.4.11 allows remote attackers to execute arbitrary code via a crafted NNTP command. Desbordamiento de búfer basado en la pila en la función split_wildmats en nntpd.c en nntpd en el servidor Cyrus IMAP antes de la verison v2.3.17 y en v2.4.x antes de v2.4.11 permite a atacantes remotos ejecutar código de su elección mediante un comando NNTP debidamente modificado. • http://asg.andrew.cmu.edu/archive/message.php?mailbox=archive.cyrus-announce&msg=199 http://asg.andrew.cmu.edu/archive/message.php?mailbox=archive.cyrus-announce&msg=200 http://git.cyrusimap.org/cyrus-imapd/commit/?id=0f8f026699829b65733c3081657b24e2174f4f4d http://git.cyrusimap.org/cyrus-imapd/commit/?id=3244c18c928fa331f6927e2b8146abe90feafddd http://lists.opensuse.org/opensuse-updates/2011-09/msg00019.html http://secunia.com/advisories/45938 http://secunia.com/advisories/45975 http://secunia.com/advisories • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 4.3EPSS: 2%CPEs: 40EXPL: 0CVE-2011-3481 – cyrus-imapd: NULL pointer dereference via crafted References header in email
https://notcve.org/view.php?id=CVE-2011-3481
The index_get_ids function in index.c in imapd in Cyrus IMAP Server before 2.4.11, when server-side threading is enabled, allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted References header in an e-mail message. La función index_get_ids en index.c en imapd del Servidor Cyrus IMAP antes de la versión v2.4.11, cuando multihilo en elado del servidor está activado, permite a atacantes remotos causar una denegación de servicio (puntero a NULL y caída del demonio) a través de una cabecera 'References' debidamente modifcada en un mensaje de correo electrónico. • http://bugzilla.cyrusimap.org/show_bug.cgi?id=2772 http://bugzilla.cyrusimap.org/show_bug.cgi?id=3463 http://git.cyrusimap.org/cyrus-imapd/commit/?id=6e776956a1a9dfa58eacdd0ddd52644009eac9e5 http://www.mandriva.com/security/advisories?name=MDVSA-2012:037 http://www.redhat.com/support/errata/RHSA-2011-1508.html https://exchange.xforce.ibmcloud.com/vulnerabilities/69842 https://access.redhat.com/security/cve/CVE-2011-3481 https://bugzilla.redhat.com/show_bug.cgi? • CWE-476: NULL Pointer Dereference •