Description
Multiple buffer overflows in Cyrus IMAPd before 2.2.11 may allow attackers to execute arbitrary code via (1) an off-by-one error in the imapd annotate extension, (2) an off-by-one error in "cached header handling," (3) a stack-based buffer overflow in fetchnews, or (4) a stack-based buffer overflow in imapd.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 4 | perl-Cyrus +5 | 2.2.12-3.RHEL4.1 | RHSA-2005:408 |
Advisories 1
- RHSA-2005:408 Red Hat Security Advisory: cyrus-imapd security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
References
- oval:org.mitre.oval:def:10674 vdb-entry signature
- 14383 third-party-advisory
- 20050228 [USN-87-1] Cyrus IMAP server vulnerability mailing-list
- MDKSA-2005:051 vendor-advisory
- 1013278 vdb-entry
- CLA-2005:937 vendor-advisory
- GLSA-200502-29 vendor-advisory
- FLSA:156290 vendor-advisory
- 12636 vdb-entry
- [info-cyrus] 20050214 Cyrus IMAPd 2.2.11 Released mailing-list
- http://bugs.gentoo.org/show_bug.cgi?id=82404
- RHSA-2005:408 vendor-advisory