Description
Buffer overflow in the SIEVE script component (sieve/script.c), as used in cyrus-imapd in Cyrus IMAP Server 2.2.13 and 2.3.14, and Dovecot 1.0 before 1.0.4 and 1.1 before 1.1.7, allows local users to execute arbitrary code and read or modify arbitrary messages via a crafted SIEVE script, related to the incorrect use of the sizeof operator for determining buffer length, combined with an integer signedness error.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | dovecot | 1:1.2.1-1 | — |
| Debian 13 | dovecot | 1:1.2.1-1 | — |
| Debian 12 | dovecot | 1:1.2.1-1 | — |
| Debian 5.0 | cyrus-imapd-2.2 | 2.2.13-14+lenny1 | DSA-1893-1, DSA-1881-1 |
| Debian 5.0 | dovecot | 1:1.0.15-2.3+lenny1 | DSA-1892-1 |
| Debian 5.0 | kolab-cyrus-imapd | 2.2.13-5+lenny2 | DSA-1893-1 |
| Debian 4.0 | cyrus-imapd-2.2 | 2.2.13-10+etch2 | DSA-1893-1, DSA-1881-1 |
| Debian 4.0 | dovecot | 1.0.rc15-2etch5 | DSA-1892-1 |
| Debian 4.0 | kolab-cyrus-imapd | 2.2.13-2+etch2 | DSA-1893-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | cyrus-imapd +3 | 2.3.7-7.el5_4.3 | RHSA-2009:1459 |
| RHEL 4 | perl-Cyrus +5 | 2.2.12-10.el4_8.4 | RHSA-2009:1459 |
Advisories 4
- RHSA-2009:1459 Red Hat Security Advisory: cyrus-imapd security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-1893-1 cyrus-imapd-2.2 kolab-cyrus-imapd - arbitrary code execution Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1892-1 dovecot - arbitrary code execution Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1881-1 cyrus-imapd - buffer overflow Debian Security (DSA / DLA) · Mar 9, 2026
References
- 36377 vdb-entry
- DSA-1881 vendor-advisory
- 36713 third-party-advisory
- [Cyrus-CVS] 20090902 src/sieve by brong mailing-list
- 36629 third-party-advisory
- https://bugzilla.andrew.cmu.edu/cgi-bin/cvsweb.cgi/src/sieve/script.c.diff?r1=1.62&r2=1.62.2.1&only_with_tag=cyrus-imapd-2_2-tail
- [Dovecot-news] 20090914 Security holes in CMU Sieve plugin mailing-list
- APPLE-SA-2010-03-29-1 vendor-advisory
- [Cyrus-CVS] 20090902 src/sieve by brong mailing-list
- 36632 third-party-advisory
- USN-838-1 vendor-advisory
- 58103 vdb-entry
- http://support.apple.com/kb/HT4077
- SUSE-SR:2009:016 vendor-advisory
- 36904 third-party-advisory
- 36698 third-party-advisory
- 36296 vdb-entry
- ADV-2009-2641 vdb-entry
- ADV-2009-2559 vdb-entry
- FEDORA-2009-9559 vendor-advisory
- oval:org.mitre.oval:def:10082 vdb-entry signature
- [oss-security] 20090914 Re: CVE for recent cyrus-imap issue mailing-list