Description
Buffer overflow in the mail_valid_net_parse_work function in mail.c for Washington's IMAP Server (UW-IMAP) before imap-2004g allows remote attackers to execute arbitrary code via a mailbox name containing a single double-quote (") character without a closing quote, which causes bytes after the double-quote to be copied into a buffer indefinitely.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 12 | uw-imap | 7:2002edebian1-12 | — |
| Debian 3.1 | uw-imap | 7:2002edebian1-11sarge1 | DSA-861-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 4 | libc-client +1 | 2002e-14 | RHSA-2005:848 |
| RHEL 4 | php +13 | 4.3.9-3.12 | RHSA-2006:0276 |
| RHEL 3 | imap +2 | 1:2002d-12 | RHSA-2005:850 |
| RHEL 3 | php +6 | 4.3.2-30.ent | RHSA-2006:0276 |
Advisories 4
- RHSA-2006:0276 Red Hat Security Advisory: php security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2005:850 Red Hat Security Advisory: imap security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2005:848 Red Hat Security Advisory: libc-client security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- DSA-861-1 up-imap - buffer overflow Debian Security (DSA / DLA) · Mar 9, 2026
References
- MDKSA-2005:194 vendor-advisory
- RHSA-2005:850 vendor-advisory
- 17950 third-party-advisory
- 21252 third-party-advisory
- 17276 third-party-advisory
- 17148 third-party-advisory
- 20222 third-party-advisory
- 20210 third-party-advisory
- http://support.avaya.com/elmodocs2/security/ASA-2006-160.htm
- 18554 third-party-advisory
- 47 third-party-advisory
- 17152 third-party-advisory
- RHSA-2006:0276 vendor-advisory
- DSA-861 vendor-advisory
- 20051004 iDEFENSE Security Advisory 10.04.05: UW-IMAP Netmailbox Name Parsing Buffer Overflow Vulnerability mailing-list
- 17062 third-party-advisory
- oval:org.mitre.oval:def:9858 vdb-entry signature
- 15009 vdb-entry
- http://www.washington.edu/imap/
- RHSA-2006:0501 vendor-advisory
- RHSA-2005:848 vendor-advisory
- RHSA-2006:0549 vendor-advisory
- 20951 third-party-advisory
- 20051004 UW-IMAP Netmailbox Name Parsing Buffer Overflow Vulnerability third-party-advisory
- uw-imap-mailbox-name-bo(22518) vdb-entry
- http://support.avaya.com/elmodocs2/security/ASA-2006-129.htm
- FLSA:170411 vendor-advisory
- 19832 third-party-advisory
- 17930 third-party-advisory
- 1015000 vdb-entry
- VU#933601 third-party-advisory
- GLSA-200510-10 vendor-advisory
- SSA:2005-310-06 vendor-advisory
- 21564 third-party-advisory
- FLSA:184098 vendor-advisory
- MDKSA-2005:189 vendor-advisory
- 17928 third-party-advisory
- 17336 third-party-advisory
- ADV-2006-2685 vdb-entry
- 17215 third-party-advisory
- SUSE-SR:2005:023 vendor-advisory
- 17483 third-party-advisory