Description
Multiple stack-based buffer overflows in the Sieve plugin in Dovecot 1.0 before 1.0.4 and 1.1 before 1.1.7, as derived from Cyrus libsieve, allow context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted SIEVE script, as demonstrated by forwarding an e-mail message to a large number of recipients, a different vulnerability than CVE-2009-2632.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | dovecot | 1:1.2.1-1 | — |
| Debian 13 | dovecot | 1:1.2.1-1 | — |
| Debian 12 | dovecot | 1:1.2.1-1 | — |
| Debian 5.0 | cyrus-imapd-2.2 | 2.2.13-14+lenny3 | DSA-1893-1 |
| Debian 5.0 | dovecot | 1:1.0.15-2.3+lenny1 | DSA-1892-1 |
| Debian 5.0 | kolab-cyrus-imapd | 2.2.13-5+lenny2 | DSA-1893-1 |
| Debian 4.0 | cyrus-imapd-2.2 | 2.2.13-10+etch4 | DSA-1893-1 |
| Debian 4.0 | dovecot | 1.0.rc15-2etch5 | DSA-1892-1 |
| Debian 4.0 | kolab-cyrus-imapd | 2.2.13-2+etch2 | DSA-1893-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | cyrus-imapd +3 | 2.3.7-7.el5_4.3 | RHSA-2009:1459 |
| RHEL 4 | perl-Cyrus +5 | 2.2.12-10.el4_8.4 | RHSA-2009:1459 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | cyrus-imapd | 2.4.18-3.4 | openSUSE-SU-2024:10015-1 |
Advisories 4
- RHSA-2009:1459 Red Hat Security Advisory: cyrus-imapd security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-1893-1 cyrus-imapd-2.2 kolab-cyrus-imapd - arbitrary code execution Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1892-1 dovecot - arbitrary code execution Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:10015-1 cyradm-2.4.18-3.4 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- 36377 vdb-entry
- cmu-sieve-dovecot-unspecified-bo(53248) vdb-entry
- 36713 third-party-advisory
- SUSE-SR:2009:018 vendor-advisory
- [Dovecot-news] 20090914 Security holes in CMU Sieve plugin mailing-list
- USN-838-1 vendor-advisory
- 58103 vdb-entry
- oval:org.mitre.oval:def:10515 vdb-entry signature
- ADV-2009-3184 vdb-entry
- SUSE-SR:2009:016 vendor-advisory
- 36904 third-party-advisory
- 36698 third-party-advisory
- ADV-2009-2641 vdb-entry
- APPLE-SA-2009-11-09-1 vendor-advisory
- FEDORA-2009-9559 vendor-advisory
- [oss-security] 20090914 Re: CVE for recent cyrus-imap issue mailing-list
- http://support.apple.com/kb/HT3937