CVE-2017-14230

EPSS 0.94%
Veröffentlicht 10.09.2017 07:29:00
Zuletzt bearbeitet 20.04.2025 01:37:25
Quelle cve@mitre.org
Teams Watchlist Login
Unerledigt Login

In the mboxlist_do_find function in imap/mboxlist.c in Cyrus IMAP before 3.0.4, an off-by-one error in prefix calculation for the LIST command caused use of uninitialized memory, which might allow remote attackers to obtain sensitive information or cause a denial of service (daemon crash) via a 'LIST "" "Other Users"' command.

Betroffene Produkte Warnungen 0 Metriken 3 CWE 1 Referenzen 7

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Cyrus ≫ Imap Version <= 3.0.3

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	0.94%	0.74

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
nvd@nist.gov	9.1	3.9	5.2	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
nvd@nist.gov	6.4	10	4.9	AV:N/AC:L/Au:N/C:P/I:N/A:P

CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

https://github.com/cyrusimap/cyrus-imapd/commit/6bd33275368edfa71ae117de895488584678ac79

Patch

Third Party Advisory

Issue Tracking

https://github.com/cyrusimap/cyrus-imapd/issues/2132

Third Party Advisory

Issue Tracking

https://lists.andrew.cmu.edu/pipermail/cyrus-announce/2017-September/000145.html

Third Party Advisory

https://www.cyrusimap.org/imap/download/release-notes/3.0/x/3.0.4.html

Third Party Advisory

Release Notes

https://nvd.nist.gov/vuln/detail/CVE-2017-14230

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2017-14230

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2017-14230

EUVD