CVE-2019-19906 affecting package cyrus-sasl 2.1.27-4

CVE-2019-19906 affecting package cyrus-sasl 2.1.27-4. A patched version of the package is available...

CVE-2020-8032 affecting package cyrus-sasl 2.1.27-4

CVE-2020-8032 affecting package cyrus-sasl 2.1.27-4. A patched version of the package is available...

cyrus-sasl (aka Cyrus SASL) 2.1.27 has an out-of-bounds write leading to unauthenticated remote denial-of-service in OpenLDAP via a malformed LDAP packet. The OpenLDAP crash is ultimately caused by an off-by-one error in _sasl_add_string in common.c in cyrus-sasl.

...

ArticaTech Artica Proxy Operating System Command Injection Vulnerability

ArticaTech Artica Proxy is an open source Artica proxy solution from the French company ArticaTech. A security vulnerability exists in the 'service-cmds' parameter of the cyrus.php file in Artica Web Proxy version 4.30.000000. A remote attacker could exploit the vulnerability to execute commands...

CVE-2020-17505

Artica Web Proxy 4.30.000000 allows an authenticated remote attacker to inject commands via the service-cmds parameter in cyrus.php. These commands are executed with root privileges via servicecmdspeform...

Security Bulletin: Vyatta 5600 vRouter Software Patches - Release 1801-ze

Summary AT&T has released versions 1801-ze for the Vyatta 5600. Details of these releases can be found at https://cloud.ibm.com/docs/infrastructure/virtual-router-appliance?topic=virtual-router-appliance-at-t-vyatta-5600-vrouter-software-patchesat-t-vyatta-5600-vrouter-software-patches...

GLSA-202006-23 : Cyrus IMAP Server: Access restriction bypass

The remote host is affected by the vulnerability described in GLSA-202006-23 Cyrus IMAP Server: Access restriction bypass An issue was discovered in Cyrus IMAP Server where sieve script uploading is excessively trusted. Impact : A user can use a sieve script to create any mailbox with administrat...

EulerOS 2.0 SP2 : cyrus-sasl (EulerOS-SA-2020-1631)

According to the version of the cyrus-sasl packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - cyrus-sasl aka Cyrus SASL 2.1.27 has an out-of-bounds write leading to unauthenticated remote denial-of-service in OpenLDAP via a malformed LDA...

Huawei EulerOS: Security Advisory for cyrus-sasl (EulerOS-SA-2020-1631)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Cyrus IMAP Server: Access restriction bypass

Background The Cyrus IMAP Server is an efficient, highly-scalable IMAP e-mail server. Description An issue was discovered in Cyrus IMAP Server where sieve script uploading is excessively trusted. Impact A user can use a sieve script to create any mailbox with administrator privileges. Workaround...

The vulnerability of many elements of the Cyrus IMAP email server, related to the lack of mechanisms for checking input data, allows attackers to compromise the integrity of information.

The vulnerability of many elements of the Cyrus IMAP email server lies in the lack of mechanisms for checking entered data. Exploiting this vulnerability allows a malicious actor to compromise the integrity of information...

Huawei EulerOS: Security Advisory for cyrus-sasl (EulerOS-SA-2020-1377)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

EulerOS 2.0 SP3 : cyrus-sasl (EulerOS-SA-2020-1377)

According to the version of the cyrus-sasl packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - cyrus-sasl aka Cyrus SASL 2.1.27 has an out-of-bounds write leading to unauthenticated remote denial-of-service in OpenLDAP via a malformed LDA...

The vulnerability of the Cyrus SASL user authentication method, related to writing beyond the buffer memory boundary, allows a attacker to cause a service denial.

The vulnerability of the Cyrus SASL user authentication method is related to improper operation of the LDAP protocol. Exploiting this vulnerability can allow a malicious actor to cause service failures...

Authentication Bypass

cyrus-imapd is vulnerable to authentication bypass. The vulnerability is allows a remote user able to use the nntpd service could use this flaw to read or post newsgroup messages on an NNTP server configured to require user authentication, without providing valid authentication credentials...

Denial Of Service (DoS)

cyrus-imapd is vulnerable to denial of service DoS. The vulnerability exists as a NULL pointer dereference flaw was found in the cyrus-imapd IMAP server, imapd. A remote attacker could send a specially-crafted mail message to a victim that would possibly prevent them from accessing their mail...

Man-in-the-Middle (MitM)

cyrus-imapd is vulnerable to man-in-the-middle MitM. The vulnerability exists as it was discovered that cyrus-imapd did not flush the received commands buffer after switching to TLS encryption for IMAP, LMTP, NNTP, and POP3 sessions. A man-in-the-middle attacker could use this flaw to inject...

Arbitrary Code Execution

postfix is vulnerable to arbitrary code execution. A heap-based buffer over-read flaw was found in the way Postfix performed SASL handlers management for SMTP sessions, when Cyrus SASL authentication was enabled. A remote attacker could use this flaw to cause the Postfix smtpd server to crash via...

Arbitrary Code Execution

cyrus-imapd is vulnerable to arbitrary code execution. A buffer overflow flaw was found in the cyrus-imapd NNTP server, nntpd. A remote user able to use the nntpd service could use this flaw to crash the nntpd child process or, possibly, execute arbitrary code with the privileges of the cyrus use...

Arbitrary Code Execution

cyrus-imapd is vulnerable to arbitrary code execution. The vulnerability exists as an authenticated user able to create Sieve mail filtering rules could use these flaws to execute arbitrary code with the privileges of the Cyrus IMAP server user...