DescriptionBuffer overflow in digestmd5.c CVS release 1.170 (also referred to as digestmda5.c), as used in the DIGEST-MD5 SASL plugin for Cyrus-SASL but not in any official releases, allows remote attackers to execute arbitrary code.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
cyrus-sasl2 (PTS)buster, buster (security)2.1.27+dfsg-1+deb10u2fixed
bullseye, bullseye (security)2.1.27+dfsg-2.1+deb11u1fixed
sid, trixie2.1.28+dfsg1-3fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
cyrus-saslsource(unstable)(not affected)


had to extract gentoo ebuild from to get details
see cyrus-sasl-2.1.18-cvs-1.172.patch in there
cyrus-sasl2 already has patch applied
oldstable version not affected, thus marking it as done with the oldstable version
- cyrus-sasl <not-affected> (cyrus-sasl code seems too old for any of the problems to apply)

Search for package or bug name: Reporting problems