Martin Prpic

**Name of the Vulnerable Software and Affected Versions** Cyrus IMAP versions 2.3.x through 2.3.18 Cyrus IMAP versions 2.4.x through 2.4.17 Cyrus IMAP versions 2.5.x through 2.5.3 **Description** The issue is caused by an out-of-bounds heap read in the `index urlfetch` function. This can allow a remote attacker to obtain sensitive information or possibly have other unspecified impact via vectors related to the `urlfetch` range. **Recommendations** For Cyrus IMAP versions 2.3.x through 2.3.18, update to version 2.3.19 or later. For Cyrus IMAP versions 2.4.x through 2.4.17, update to version 2.4.18 or later. For Cyrus IMAP versions 2.5.x through 2.5.3, update to version 2.5.4 or later.

**Name of the Vulnerable Software and Affected Versions** Cyrus IMAP versions 2.3.19 through 2.5.6 **Description** The issue is caused by an integer overflow in the `index urlfetch` function in `imap/index.c`, which can be exploited by remote attackers to have an unspecified impact. This is related to `urlfetch` range checks and the `start octet` variable. The vulnerability exists due to an incomplete fix for a previous issue. **Recommendations** For versions 2.3.19, 2.4.18, and 2.5.6, consider disabling the `index urlfetch` function as a temporary workaround until a patch is available. Restrict access to the `imap/index.c` module to minimize the risk of exploitation. Avoid using the `start octet` variable in the affected `urlfetch` range checks until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.