Description
Multiple integer signedness errors in (1) imapcommon.c, (2) main.c, (3) request.c, and (4) select.c for up-imapproxy IMAP proxy 1.2.2 allow remote attackers to cause a denial of service (server crash) and possibly leak sensitive information via certain literal values that are not properly handled when using the IMAP_Line_Read function.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | up-imapproxy | 1.2.2+1.2.3rc2-1 | — |
| Debian 13 | up-imapproxy | 1.2.2+1.2.3rc2-1 | — |
| Debian 12 | up-imapproxy | 1.2.2+1.2.3rc2-1 | — |
References
- 20041107 up-imapproxy DoS vulnerabilities mailing-list
- upimapproxy-dos(17999) vdb-entry