CVE-2009-2632
- State
- Published
- Severity
- Not scored
- Published
- Sep 8, 2009
- Updated
- Aug 7, 2024
- Reserved
- Jul 28, 2009
Description
Buffer overflow in the SIEVE script component (sieve/script.c), as used in cyrus-imapd in Cyrus IMAP Server 2.2.13 and 2.3.14, and Dovecot 1.0 before 1.0.4 and 1.1 before 1.1.7, allows local users to execute arbitrary code and read or modify arbitrary messages via a crafted SIEVE script, related to the incorrect use of the sizeof operator for determining buffer length, combined with an integer signedness error.
Scores
The record has no CVSS score.
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
n/an/a |
|
References
- 36377vdb-entry
- DSA-1881vendor-advisory
- 36713third-party-advisory
- [Cyrus-CVS] 20090902 src/sieve by brongmailing-list
- 36629third-party-advisory
- https://bugzilla.andrew.cmu.edu/cgi-bin/cvsweb.cgi/src/sieve/script.c.diff?r1=1.62&r2=1.62.2.1&only_with_tag=cyrus-imapd-2_2-tail
- [Dovecot-news] 20090914 Security holes in CMU Sieve pluginmailing-list
- APPLE-SA-2010-03-29-1vendor-advisory
- [Cyrus-CVS] 20090902 src/sieve by brongmailing-list
- 36632third-party-advisory
- USN-838-1vendor-advisory
- 58103vdb-entry
- http://support.apple.com/kb/HT4077
- SUSE-SR:2009:016vendor-advisory
- 36904third-party-advisory
- 36698third-party-advisory
- 36296vdb-entry
- ADV-2009-2641vdb-entry
- ADV-2009-2559vdb-entry
- FEDORA-2009-9559vendor-advisory
- oval:org.mitre.oval:def:10082vdb-entrysignature
- [oss-security] 20090914 Re: CVE for recent cyrus-imap issuemailing-list
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.