CVE-2009-3235

NameCVE-2009-3235
DescriptionMultiple stack-based buffer overflows in the Sieve plugin in Dovecot 1.0 before 1.0.4 and 1.1 before 1.1.7, as derived from Cyrus libsieve, allow context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted SIEVE script, as demonstrated by forwarding an e-mail message to a large number of recipients, a different vulnerability than CVE-2009-2632.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDSA-1892-1, DSA-1893-1
Debian Bugs546656, 547712, 547947

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
dovecot (PTS)bullseye1:2.3.13+dfsg1-2+deb11u1fixed
bullseye (security)1:2.3.13+dfsg1-2+deb11u2fixed
bookworm, bookworm (security)1:2.3.19.1+dfsg1-2.1+deb12u1fixed
sid, trixie1:2.3.21.1+dfsg1-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
cyrus-imapd-2.2sourceetch2.2.13-10+etch4DSA-1893-1
cyrus-imapd-2.2sourcelenny2.2.13-14+lenny3DSA-1893-1
cyrus-imapd-2.2source(unstable)2.2.13-17medium547947
dovecotsourceetch1.0.rc15-2etch5DSA-1892-1
dovecotsourcelenny1:1.0.15-2.3+lenny1DSA-1892-1
dovecotsource(unstable)1:1.2.1-1medium546656
kolab-cyrus-imapdsourceetch2.2.13-2+etch2DSA-1893-1
kolab-cyrus-imapdsourcelenny2.2.13-5+lenny2DSA-1893-1
kolab-cyrus-imapdsource(unstable)2.2.13-5.1medium547712

Notes

This is a different vulnerability than CVE-2009-2632, it covers a few additional buffer overflows

Search for package or bug name: Reporting problems