CVE-2009-2632

Cyrus IMAP Server <2.3.14 & Dovecot <1.1.7 - RCE

Title source: llm

Description

Buffer overflow in the SIEVE script component (sieve/script.c), as used in cyrus-imapd in Cyrus IMAP Server 2.2.13 and 2.3.14, and Dovecot 1.0 before 1.0.4 and 1.1 before 1.1.7, allows local users to execute arbitrary code and read or modify arbitrary messages via a crafted SIEVE script, related to the incorrect use of the sizeof operator for determining buffer length, combined with an integer signedness error.

References (22)

Core 22

Core References

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/36377

Patch vendor-advisory x_refsource_debian

http://www.debian.org/security/2009/dsa-1881

Third Party Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/36713

Various Sources mailing-list x_refsource_mlist

https://lists.andrew.cmu.edu/pipermail/cyrus-cvs/2009-September/001254.html

Vendor Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/36629

Issue Tracking x_refsource_confirm

https://bugzilla.andrew.cmu.edu/cgi-bin/cvsweb.cgi/src/sieve/script.c.diff?r1=1.62&r2=1.62.2.1&only_with_tag=cyrus-imapd-2_2-tail

Various Sources mailing-list x_refsource_mlist

http://dovecot.org/list/dovecot-news/2009-September/000135.html

Mailing List vendor-advisory x_refsource_apple

http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html

Various Sources mailing-list x_refsource_mlist

https://lists.andrew.cmu.edu/pipermail/cyrus-cvs/2009-September/001253.html

Vendor Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/36632

Vendor Advisory vendor-advisory x_refsource_ubuntu

http://www.ubuntu.com/usn/USN-838-1

Third Party Advisory, VDB Entry vdb-entry x_refsource_osvdb

http://www.osvdb.org/58103

Vendor Advisory x_refsource_confirm

http://support.apple.com/kb/HT4077

Mailing List vendor-advisory x_refsource_suse

http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00001.html

Third Party Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/36904

Third Party Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/36698

Patch vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/36296

Third Party Advisory vdb-entry x_refsource_vupen

http://www.vupen.com/english/advisories/2009/2641

Patch, Vendor Advisory vdb-entry x_refsource_vupen

http://www.vupen.com/english/advisories/2009/2559

Vendor Advisory vendor-advisory x_refsource_fedora

https://www.redhat.com/archives/fedora-package-announce/2009-September/msg00491.html

Third Party Advisory, VDB Entry vdb-entry signature x_refsource_oval

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10082

Mailing List mailing-list x_refsource_mlist

http://www.openwall.com/lists/oss-security/2009/09/14/3

Scores

EPSS 0.0048

EPSS Percentile 38.3%

Details

CWE

CWE-119

Status published

Products (2)

cmu/cyrus_imap_server 2.2.13

cmu/cyrus_imap_server 2.3.14

Published Sep 08, 2009

Tracked Since Feb 18, 2026