CVE-2015-8077
Fixed in a distro release EPSS 3%
Integer overflow in the index_urlfetch function in imap/index.c in Cyrus IMAP 2.3.19, 2.4.18, and 2.5.6 allows remote attackers to have unspecified impact via vectors related to urlfetch range checks and the start_octet variable. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-8076.
Products: cyrus imap, opensuse leap, opensuse
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| SUSE Linux Enterprise Server 11 SP4 | cyrus-imapd | 2.3.11-60.65.67.1 |
| SUSE Linux Enterprise Server 12 | cyrus-imapd | 2.3.18-37.1 |
| SUSE Linux Enterprise Server 12 SP1 | cyrus-imapd | 2.3.18-37.1 |
| SUSE Linux Enterprise Server for SAP Applications 11 SP4 | cyrus-imapd | 2.3.11-60.65.67.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 | cyrus-imapd | 2.3.18-37.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP1 | cyrus-imapd | 2.3.18-37.1 |
| SUSE Linux Enterprise Software Development Kit 11 SP4 | cyrus-imapd | 2.3.11-60.65.67.1 |
| Ubuntu 16.04 LTS | cyrus-imapd-2.4 | no fix |
| openSUSE Tumbleweed | cyrus-imapd | 2.4.18-3.4 |