cyrus, perl security update

2011-09-2203:04:50

CentOS Project

lists.centos.org

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.262 Low

EPSS

Percentile

96.7%

JSON

CentOS Errata and Security Advisory CESA-2011:1317

The cyrus-imapd packages contain a high-performance mail server with IMAP,
POP3, NNTP, and Sieve support.

A buffer overflow flaw was found in the cyrus-imapd NNTP server, nntpd. A
remote user able to use the nntpd service could use this flaw to crash the
nntpd child process or, possibly, execute arbitrary code with the
privileges of the cyrus user. (CVE-2011-3208)

Red Hat would like to thank Greg Banks for reporting this issue.

Users of cyrus-imapd are advised to upgrade to these updated packages,
which contain a backported patch to correct this issue. After installing
the update, cyrus-imapd will be restarted automatically.

Merged security bulletin from advisories:
https://lists.centos.org/pipermail/centos-announce/2011-September/079908.html
https://lists.centos.org/pipermail/centos-announce/2011-September/079909.html
https://lists.centos.org/pipermail/centos-announce/2011-September/080228.html
https://lists.centos.org/pipermail/centos-announce/2011-September/080229.html

Affected packages:
cyrus-imapd
cyrus-imapd-devel
cyrus-imapd-murder
cyrus-imapd-nntp
cyrus-imapd-perl
cyrus-imapd-utils
perl-Cyrus

Upstream details at:
https://access.redhat.com/errata/RHSA-2011:1317

OSVersionArchitecturePackageVersionFilename
CentOS5i386cyrus-imapd< 2.3.7-12.el5_7.1cyrus-imapd-2.3.7-12.el5_7.1.i386.rpm
CentOS5i386cyrus-imapd-devel< 2.3.7-12.el5_7.1cyrus-imapd-devel-2.3.7-12.el5_7.1.i386.rpm
CentOS5i386cyrus-imapd-perl< 2.3.7-12.el5_7.1cyrus-imapd-perl-2.3.7-12.el5_7.1.i386.rpm
CentOS5i386cyrus-imapd-utils< 2.3.7-12.el5_7.1cyrus-imapd-utils-2.3.7-12.el5_7.1.i386.rpm
CentOS5x86_64cyrus-imapd< 2.3.7-12.el5_7.1cyrus-imapd-2.3.7-12.el5_7.1.x86_64.rpm
CentOS5i386cyrus-imapd-devel< 2.3.7-12.el5_7.1cyrus-imapd-devel-2.3.7-12.el5_7.1.i386.rpm
CentOS5x86_64cyrus-imapd-devel< 2.3.7-12.el5_7.1cyrus-imapd-devel-2.3.7-12.el5_7.1.x86_64.rpm
CentOS5x86_64cyrus-imapd-perl< 2.3.7-12.el5_7.1cyrus-imapd-perl-2.3.7-12.el5_7.1.x86_64.rpm
CentOS5x86_64cyrus-imapd-utils< 2.3.7-12.el5_7.1cyrus-imapd-utils-2.3.7-12.el5_7.1.x86_64.rpm
CentOS4i386cyrus-imapd< 2.2.12-16.el4cyrus-imapd-2.2.12-16.el4.i386.rpm

OS	Version	Architecture	Package	Version	Filename
CentOS	5	i386	cyrus-imapd	< 2.3.7-12.el5_7.1	cyrus-imapd-2.3.7-12.el5_7.1.i386.rpm
CentOS	5	i386	cyrus-imapd-devel	< 2.3.7-12.el5_7.1	cyrus-imapd-devel-2.3.7-12.el5_7.1.i386.rpm
CentOS	5	i386	cyrus-imapd-perl	< 2.3.7-12.el5_7.1	cyrus-imapd-perl-2.3.7-12.el5_7.1.i386.rpm
CentOS	5	i386	cyrus-imapd-utils	< 2.3.7-12.el5_7.1	cyrus-imapd-utils-2.3.7-12.el5_7.1.i386.rpm
CentOS	5	x86_64	cyrus-imapd	< 2.3.7-12.el5_7.1	cyrus-imapd-2.3.7-12.el5_7.1.x86_64.rpm
CentOS	5	i386	cyrus-imapd-devel	< 2.3.7-12.el5_7.1	cyrus-imapd-devel-2.3.7-12.el5_7.1.i386.rpm
CentOS	5	x86_64	cyrus-imapd-devel	< 2.3.7-12.el5_7.1	cyrus-imapd-devel-2.3.7-12.el5_7.1.x86_64.rpm
CentOS	5	x86_64	cyrus-imapd-perl	< 2.3.7-12.el5_7.1	cyrus-imapd-perl-2.3.7-12.el5_7.1.x86_64.rpm
CentOS	5	x86_64	cyrus-imapd-utils	< 2.3.7-12.el5_7.1	cyrus-imapd-utils-2.3.7-12.el5_7.1.x86_64.rpm
CentOS	4	i386	cyrus-imapd	< 2.2.12-16.el4	cyrus-imapd-2.2.12-16.el4.i386.rpm