Cyrus IMAP 2.5.x < 2.5.15, 3.0.x < 3.0.13 ACL Bypass Vulnerability

Cyrus IMAP is prone to an ACL bypass vulnerability. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:cyrus:imap"; if description...

Cyrus IMAP Elevation of Privilege Vulnerability

Cyrus IMAP is a Unix and Linux-based operating system for supporting IMAP Interactive Mail Access Protocol protocol open source mail server . A security vulnerability exists in Cyrus IMAP versions prior to 2.5.15, 3.0.x prior to 3.0.13, and 3.1.x through 3.1.8. An attacker can exploit the...

CVE-2019-19783

An issue was discovered in Cyrus IMAP before 2.5.15, 3.0.x before 3.0.13, and 3.1.x through 3.1.8. If sieve script uploading is allowed 3.x or certain non-default sieve options are enabled 2.x, a user with a mail account on the service can use a sieve script containing a fileinto directive to...

CVE-2019-19783

An issue was discovered in Cyrus IMAP before 2.5.15, 3.0.x before 3.0.13, and 3.1.x through 3.1.8. If sieve script uploading is allowed 3.x or certain non-default sieve options are enabled 2.x, a user with a mail account on the service can use a sieve script containing a fileinto directive to...

DEBIAN-CVE-2019-19783

An issue was discovered in Cyrus IMAP before 2.5.15, 3.0.x before 3.0.13, and 3.1.x through 3.1.8. If sieve script uploading is allowed 3.x or certain non-default sieve options are enabled 2.x, a user with a mail account on the service can use a sieve script containing a fileinto directive to...

Design/Logic Flaw

An issue was discovered in Cyrus IMAP before 2.5.15, 3.0.x before 3.0.13, and 3.1.x through 3.1.8. If sieve script uploading is allowed 3.x or certain non-default sieve options are enabled 2.x, a user with a mail account on the service can use a sieve script containing a fileinto directive to...

CVE-2019-19783

An issue was discovered in Cyrus IMAP before 2.5.15, 3.0.x before 3.0.13, and 3.1.x through 3.1.8. If sieve script uploading is allowed 3.x or certain non-default sieve options are enabled 2.x, a user with a mail account on the service can use a sieve script containing a fileinto directive to...

UBUNTU-CVE-2019-19783

An issue was discovered in Cyrus IMAP before 2.5.15, 3.0.x before 3.0.13, and 3.1.x through 3.1.8. If sieve script uploading is allowed 3.x or certain non-default sieve options are enabled 2.x, a user with a mail account on the service can use a sieve script containing a fileinto directive to...

CVE-2019-19783

CVE-2019-19783 affects Cyrus IMAP (cyrus-imapd) where the lmtpd sieve handling could allow a user to create a mailbox with administrator privileges via a fileinto directive, due to folder handling in autosieve_createfolder() in imap/lmtp_sieve.c. Affected: 2.5.x (before 2.5.15), 3.0.x (before 3.0...

CVE-2019-19783

An issue was discovered in Cyrus IMAP before 2.5.15, 3.0.x before 3.0.13, and 3.1.x through 3.1.8. If sieve script uploading is allowed 3.x or certain non-default sieve options are enabled 2.x, a user with a mail account on the service can use a sieve script containing a fileinto directive to...

CVE-2019-19783

An issue was discovered in Cyrus IMAP before 2.5.15, 3.0.x before 3.0.13, and 3.1.x through 3.1.8. If sieve script uploading is allowed 3.x or certain non-default sieve options are enabled 2.x, a user with a mail account on the service can use a sieve script containing a fileinto directive to...

CVE-2019-19783: Improper Privilege Management

An issue was discovered in Cyrus IMAP before 2.5.15, 3.0.x before 3.0.13, and 3.1.x through 3.1.8. If sieve script uploading is allowed 3.x or certain non-default sieve options are enabled 2.x, a user with a mail account on the service can use a sieve script containing a fileinto directive to...

PT-2019-5233 · Cyrus +4 · Cyrus Imap +4

Name of the Vulnerable Software and Affected Versions: Cyrus IMAP versions prior to 2.5.15 Cyrus IMAP versions 3.0.x prior to 3.0.13 Cyrus IMAP versions 3.1.x through 3.1.8 Description: The issue is related to a lack of input validation mechanism in the Cyrus IMAP server, which can be exploited b...

Fedora Update for cyrus-imapd FEDORA-2019-393e1cef4d

The remote host is missing an update for the Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Fedora 31 : cyrus-imapd (2019-03be160f9c)

Update to version 3.0.12 of cyrus-imapd, which includes among other fixes a fix for CVE-2019-18928. https://www.cyrusimap.org/imap/download/release-notes/3.0/x/3.0.12.htm l Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system...

Fedora 30 : cyrus-imapd (2019-393e1cef4d)

Update to version 3.0.12 of cyrus-imapd, which includes among other fixes a fix for CVE-2019-18928. https://www.cyrusimap.org/imap/download/release-notes/3.0/x/3.0.12.htm l Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system...

PT-2019-4873 · Openldap +8 · Openldap +8

Name of the Vulnerable Software and Affected Versions: cyrus-sasl version 2.1.27 Description: The issue is related to an out-of-bounds write that can cause an unauthenticated remote denial-of-service in OpenLDAP via a malformed LDAP packet. This is ultimately caused by an off-by-one error in the...

Security fix for the ALT Linux 8 package cyrus-imapd version 2.5.14-alt0.M80P.1

2.5.14-alt0.M80P.1 built Nov. 22, 2019 Sergey Y. Afonin in task 240906 Nov. 17, 2019 Sergey Y. Afonin - 2.5.14 fixes: CVE-2019-18928 - logging of reached limits the patch from the https://github.com/cyrusimap/cyrus-imapd/issues/2913...

CVE-2019-18928

Cyrus IMAP 2.5.x before 2.5.14 and 3.x before 3.0.12 allows privilege escalation because an HTTP request may be interpreted in the authentication context of an unrelated previous request that arrived over the same connection...

Security fix for the ALT Linux 9 package cyrus-imapd version 3.0.12-alt1

3.0.12-alt1 built Nov. 20, 2019 Sergey Y. Afonin in task 240896 Nov. 16, 2019 Sergey Y. Afonin - 3.0.12 fixes: CVE-2019-18928 - logging of reached limits the patch from the https://github.com/cyrusimap/cyrus-imapd/issues/2913...