4 results (0.007 seconds)

CVSS: 7.5EPSS: 0%CPEs: 6EXPL: 0

CVE-2021-33582 – cyrus-imapd: Denial of service via string hashing algorithm collisions

https://notcve.org/view.php?id=CVE-2021-33582

Cyrus IMAP before 3.4.2 allows remote attackers to cause a denial of service (multiple-minute daemon hang) via input that is mishandled during hash-table interaction. Because there are many insertions into a single bucket, strcmp becomes slow. This is fixed in 3.4.2, 3.2.8, and 3.0.16. Cyrus IMAP versiones anteriores a 3.4.2, permite a atacantes remotos causar una denegación de servicio (cuelgue del demonio de varios minutos) por medio de una entrada manejada inapropiadamente durante la interacción de la tabla hash. Debido a que presenta muchas inserciones en un solo cubo, strcmp se vuelve lento. • https://cyrus.topicbox.com/groups/announce/T3dde0a2352462975-M1386fc44adf967e072f8df13/cyrus-imap-3-4-2-3-2-8-and-3-0-16-released https://github.com/cyrusimap/cyrus-imapd/commits/master https://github.com/cyrusimap/cyrus-imapd/security/advisories https://lists.debian.org/debian-lts-announce/2022/06/msg00013.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6HEO3RURJW6NLIXS7NK5PVU6MGHC4SCM https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org • CWE-400: Uncontrolled Resource Consumption CWE-407: Inefficient Algorithmic Complexity •

CVSS: 4.3EPSS: 0%CPEs: 4EXPL: 0

CVE-2021-32056

https://notcve.org/view.php?id=CVE-2021-32056

Cyrus IMAP before 3.2.7, and 3.3.x and 3.4.x before 3.4.1, allows remote authenticated users to bypass intended access restrictions on server annotations and consequently cause replication to stall. Cyrus IMAP versiones anteriores a 3.2.7, y versiones 3.3.x y versiones 3.4.x anteriores a 3.4.1, permite a usuarios autenticados remotos omitir las restricciones de acceso previstas en las anotaciones del servidor y, en consecuencia, provocar que la replicación se detenga • https://cyrus.topicbox.com/groups/announce/T056901c106ecfce3/cyrus-imap-3-4-1-released https://cyrus.topicbox.com/groups/announce/T126392718bc29d6b/cyrus-imap-3-2-7-released https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6HEO3RURJW6NLIXS7NK5PVU6MGHC4SCM https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WJZB45QBUN7CZFGOWCZYUYACNBTX7LVS https://www.cyrusimap.org/imap/download/release-notes/3.2/x/3.2.7.html https://www.cyrusimap.org/ • CWE-732: Incorrect Permission Assignment for Critical Resource •

CVSS: 6.5EPSS: 0%CPEs: 8EXPL: 0

CVE-2019-19783 – cyrus-imapd: lmtpd component created mailboxes with administrator privileges if the "fileinto" was used, bypassing ACL checks

https://notcve.org/view.php?id=CVE-2019-19783

An issue was discovered in Cyrus IMAP before 2.5.15, 3.0.x before 3.0.13, and 3.1.x through 3.1.8. If sieve script uploading is allowed (3.x) or certain non-default sieve options are enabled (2.x), a user with a mail account on the service can use a sieve script containing a fileinto directive to create any mailbox with administrator privileges, because of folder mishandling in autosieve_createfolder() in imap/lmtp_sieve.c. Se detectó un problema en Cyrus IMAP versiones anteriores a 2.5.15, versiones 3.0.x antes de 3.0.13 y versiones 3.1.x hasta 3.1.8. Si la carga de script tamizado está permitida (versiones 3.x) o ciertas opciones de tamizado no predeterminadas están habilitadas (versiones 2.x), un usuario con una cuenta de correo en el servicio puede usar un script tamizado que contiene un archivo en la directiva para crear cualquier buzón con el administrador privilegios, debido a un manejo inapropiado de la carpeta en la función autosieve_createfolder() en el archivo imap/lmtp_sieve.c. • https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2DIV4HQ6LG5GPRO4B5Z2NHCZUPBUVVVF https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6IGOO5UGEBBDPN7B2YXLK7I7L3Y35EBA https://seclists.org/bugtraq/2019/Dec/38 https://security.gentoo.org/glsa/202006-23 https://usn.ubuntu.com/4566-1 https://www.cyrusimap.org/imap/download/release-notes/2.5/x/2.5.15.html https://www.cyrusimap.org/imap/download/release-notes/3.0/x/3.0 • CWE-269: Improper Privilege Management CWE-287: Improper Authentication •

CVSS: 4.3EPSS: 0%CPEs: 37EXPL: 0

CVE-2008-5514

https://notcve.org/view.php?id=CVE-2008-5514

Off-by-one error in the rfc822_output_char function in the RFC822BUFFER routines in the University of Washington (UW) c-client library, as used by the UW IMAP toolkit before imap-2007e and other applications, allows context-dependent attackers to cause a denial of service (crash) via an e-mail message that triggers a buffer overflow. Error de superación de límite en la función rfc822_output_char en las rutinas RFC822BUFFER de las bibliotecas c-client library, de la Universidad de Washinton (UW), como las utilizadas en por el Juego de herramientas UW IMAP anteriores a imap-2007e y otras aplicaciones, permiten a atacantes, despendiendo del contexto, provocar una denegación de servicio (caída) a través de un correo electrónico, que desencadene un desbordamiento de buffer. • http://secunia.com/advisories/33275 http://secunia.com/advisories/33638 http://securitytracker.com/id?1021485 http://www.mandriva.com/security/advisories?name=MDVSA-2009:146 http://www.securityfocus.com/bid/32958 http://www.vupen.com/english/advisories/2008/3490 http://www.washington.edu/imap/documentation/RELNOTES.html https://bugzilla.redhat.com/show_bug.cgi?id=477227 https://exchange.xforce.ibmcloud.com/vulnerabilities/47526 https://www.redhat.com/archives/fedora-package-announce/2009&# • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •