Description
Off-by-one error in the rfc822_output_char function in the RFC822BUFFER routines in the University of Washington (UW) c-client library, as used by the UW IMAP toolkit before imap-2007e and other applications, allows context-dependent attackers to cause a denial of service (crash) via an e-mail message that triggers a buffer overflow.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | alpine | 2.02-3.1 | — |
| Debian 13 | alpine | 2.02-3.1 | — |
| Debian 12 | alpine | 2.02-3.1 | — |
| Debian 12 | uw-imap | 2007b~dfsg-1.1 | — |
| Debian 5.0 | uw-imap | 2007b~dfsg-4+lenny3 | DTSA-174-2 |
Advisories 1
- DTSA-174-2 uw-imap - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
References
- http://www.washington.edu/imap/documentation/RELNOTES.html
- 33275 third-party-advisory
- 32958 vdb-entry
- 33638 third-party-advisory
- uwimapd-rfc822outputchar-dos(47526) vdb-entry
- 1021485 vdb-entry
- FEDORA-2009-0371 vendor-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=477227
- ADV-2008-3490 vdb-entry
- MDVSA-2009:146 vendor-advisory