1594 matches found
Security fix for the ALT Linux 8 package cyrus-imapd version 2.2.9-alt1
Nov. 23, 2004 Alexei Takaseev 2.2.9-alt1 - 2.2.9 - This release implements several bugfixes, notably one where lmtpproxyd could reuse a freed connection, another involving a pre-authentication buffer overrun in "imap magic plus" support CAN-2004-1011 and lack of bounds checking in PARTIAL and...
Cyrus IMAPD < 2.2.10 Multiple Vulnerabilities
Binary data 2425.prm...
Debian DSA-568-1 : cyrus-sasl-mit - unsanitised input
A vulnerability has been discovered in the Cyrus implementation of the SASL library, the Simple Authentication and Security Layer, a method for adding authentication support to connection-based protocols. The library honors the environment variable SASLPATH blindly, which allows a local user to...
Debian DSA-563-3 : cyrus-sasl - unsanitised input
This advisory is an addition to DSA 563-1 and 563-2 which weren't able to supersede the library on sparc and arm due to a different version number for them in the stable archive. Other architectures were updated properly. Another problem was reported in connection with sendmail, though, which...
Cyrus IMAPd -- FETCH command out of bounds memory corruption
The argument parser of the fetch command suffers a bug very similiar to the partial command problem. Arguments like "bodyp", "binaryp" or "binaryp" will be wrongly detected and the bufferposition can point outside of the allocated buffer for the rest of the parsing process. When the parser trigge...
Cyrus IMAPd -- PARTIAL command out of bounds memory corruption
Due to a bug within the argument parser of the partial command an argument like "bodyp" will be wrongly detected as "body.peek". Because of this the bufferposition gets increased by 10 instead of 5 and could therefore point outside the allocated memory buffer for the rest of the parsing process. ...
Cyrus IMAPd -- APPEND command uses undefined programming construct
To support MULTIAPPENDS the cmdappend handler uses the global stage array. This array is one of the things that gets destructed when the fatal function is triggered. When the Cyrus IMAP code adds new entries to this array this is done with the help of the postfix increment operator in combination...
Cyrus IMAPd -- IMAPMAGICPLUS preauthentification overflow
When the option imapmagicplus is activated on a server the PROXY and LOGIN commands suffer a standard stack overflow, because the username is not checked against a maximum length when it is copied into a temporary stack buffer. This bug is especially dangerous because it can be triggered before a...
CVE-2004-0884
The 1 libsasl and 2 libsasl2 libraries in Cyrus-SASL 2.1.18 and earlier trust the SASLPATH environment variable to find all available SASL plug-ins, which allows local users to execute arbitrary code by modifying the SASLPATH to point to malicious programs...
CVE-2004-0884
The 1 libsasl and 2 libsasl2 libraries in Cyrus-SASL 2.1.18 and earlier trust the SASLPATH environment variable to find all available SASL plug-ins, which allows local users to execute arbitrary code by modifying the SASLPATH to point to malicious programs...
CVE-2004-0884
CVE-2004-0884 affects the Cyrus-SASL libraries (libsasl and libsasl2) up to version 2.1.18. The vulnerability arises because these libraries trust the SASL_PATH environment variable to locate SASL plug-ins, allowing a local attacker to cause arbitrary code execution by pointing SASL_PATH to malic...
FreeBSD : cyrus-sasl -- dynamic library loading and set-user-ID applications (35)
The following package needs to be updated: cyrus-sasl %NASLMINLEVEL 999999 @DEPRECATED@ This script has been deprecated by freebsdpkg92268205194711d9bc4a000c41e2cdad.nasl. Disabled on 2011/10/02. C Tenable Network Security, Inc. This script contains information extracted from VuXML : Copyright...
[SECURITY] [DSA 568-1] New cyrus-sasl-mit packages fix arbitrary code execution
-------------------------------------------------------------------------- Debian Security Advisory DSA 568-1 [email protected] http://www.debian.org/security/ Martin Schulze October 16th, 2004 http://www.debian.org/security/faq -...
[SECURITY] [DSA 568-1] New cyrus-sasl-mit packages fix arbitrary code execution
-------------------------------------------------------------------------- Debian Security Advisory DSA 568-1 [email protected] http://www.debian.org/security/ Martin Schulze October 16th, 2004 http://www.debian.org/security/faq -...
DSA-568-1 cyrus-sasl-mit - unsanitised input
Bulletin has no description...
[SECURITY] [DSA 563-3] New cyrus-sasl packages fix arbitrary code execution on sparc and arm
-------------------------------------------------------------------------- Debian Security Advisory DSA 563-3 [email protected] http://www.debian.org/security/ Martin Schulze October 14th, 2004 http://www.debian.org/security/faq -...
[SECURITY] [DSA 563-3] New cyrus-sasl packages fix arbitrary code execution on sparc and arm
-------------------------------------------------------------------------- Debian Security Advisory DSA 563-3 [email protected] http://www.debian.org/security/ Martin Schulze October 14th, 2004 http://www.debian.org/security/faq -...
[SECURITY] [DSA 563-2] New cyrus-sasl packages really fix arbitrary code execution
-------------------------------------------------------------------------- Debian Security Advisory DSA 563-2 [email protected] http://www.debian.org/security/ Martin Schulze October 12th, 2004 http://www.debian.org/security/faq -...
[SECURITY] [DSA 563-2] New cyrus-sasl packages really fix arbitrary code execution
-------------------------------------------------------------------------- Debian Security Advisory DSA 563-2 [email protected] http://www.debian.org/security/ Martin Schulze October 12th, 2004 http://www.debian.org/security/faq -...
[SECURITY] [DSA 563-1] New cyrus-sasl packages fix arbitrary code execution
-------------------------------------------------------------------------- Debian Security Advisory DSA 563-1 [email protected] http://www.debian.org/security/ Martin Schulze October 12th, 2004 http://www.debian.org/security/faq -...