CVE-2009-0688

NameCVE-2009-0688
DescriptionMultiple buffer overflows in the CMU Cyrus SASL library before 2.1.23 might allow remote attackers to execute arbitrary code or cause a denial of service (application crash) via strings that are used as input to the sasl_encode64 function in lib/saslutil.c.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDSA-1807-1, DTSA-200-1, DTSA-201-1
Debian Bugs528749

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
cyrus-sasl2 (PTS)bullseye (security), bullseye2.1.27+dfsg-2.1+deb11u1fixed
bookworm2.1.28+dfsg-10fixed
sid, trixie2.1.28+dfsg1-8fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
cyrus-sasl2sourceetch2.1.22.dfsg1-8+etch1DSA-1807-1
cyrus-sasl2sourcelenny2.1.22.dfsg1-23+lenny1DSA-1807-1
cyrus-sasl2sourcesqueeze2.1.22.dfsg1-23+squeeze1DTSA-200-1
cyrus-sasl2source(unstable)2.1.23.dfsg1-1528749
cyrus-sasl2-heimdalsourcelenny2.1.22.dfsg1-23+lenny1DSA-1807-1
cyrus-sasl2-heimdalsourcesqueeze2.1.22.dfsg1-23+squeeze1DTSA-201-1
cyrus-sasl2-heimdalsource(unstable)2.1.23.dfsg1-1

Notes

VU#238019

Search for package or bug name: Reporting problems