PT-2015-3147 · Cyrus+2 · Cyrus Imap+2

Martin Prpic · Publicado 2015-07-11 · Atualizado 2018-10-30 · CVE-2015-8076

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Cyrus IMAP versions 2.3.x through 2.3.18 Cyrus IMAP versions 2.4.x through 2.4.17 Cyrus IMAP versions 2.5.x through 2.5.3

Description The issue is caused by an out-of-bounds heap read in the index urlfetch function. This can allow a remote attacker to obtain sensitive information or possibly have other unspecified impact via vectors related to the urlfetch range.

Recommendations For Cyrus IMAP versions 2.3.x through 2.3.18, update to version 2.3.19 or later. For Cyrus IMAP versions 2.4.x through 2.4.17, update to version 2.4.18 or later. For Cyrus IMAP versions 2.5.x through 2.5.3, update to version 2.5.4 or later.

Correção

Buffer Overflow

Information Disclosure

Enumeração de Fraquezas

CWE-119

CWE-200

Identificadores relacionados

ALT-PU-2015-1604

BDU:2016-00362

CVE-2015-8076

SUSE-SU-2016:1457-1

SUSE-SU-2016:1459-1

Produtos afetados

Alt Linux

Cyrus Imap

Suse

Referências · 37

• https://ubuntu.com/security/CVE-2015-8076 · Aviso do Fabricante
• https://suse.com/support/update/announcement/2016/suse-su-20161459-1 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2015-8076 · Nota de Segurança
• https://osv.dev/vulnerability/UBUNTU-CVE-2015-8076 · Aviso do Fabricante
• https://bugzilla.suse.com/860611 · Nota
• http://lists.opensuse.org/opensuse-updates/2015-09/msg00037.html · Aviso do Fabricante
• https://bugzilla.suse.com/981670 · Nota
• https://osv.dev/vulnerability/SUSE-SU-2016:1459-1 · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2015/09/29/2 · Nota
• https://cyrus.foundation/cyrus-imapd/commit/?id=c21e179c1f6b968fe69bebe079176714e511587b · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2015-8076 · Nota de Segurança
• http://openwall.com/lists/oss-security/2015/09/30/3 · Nota
• https://suse.com/security/cve/CVE-2015-8078 · Nota
• https://bdu.fstec.ru/vul/2016-00363 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8077 · Nota de Segurança