CVE-2009-3235

NameCVE-2009-3235
DescriptionMultiple stack-based buffer overflows in the Sieve plugin in Dovecot 1.0 before 1.0.4 and 1.1 before 1.1.7, as derived from Cyrus libsieve, allow context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted SIEVE script, as demonstrated by forwarding an e-mail message to a large number of recipients, a different vulnerability than CVE-2009-2632.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SuSE, Mageia, GitHub code/issues, web search, more)
ReferencesDSA-1892-1, DSA-1893-1
NVD severityhigh (attack range: remote)
Debian Bugs546656, 547712, 547947

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
dovecot (PTS)wheezy, wheezy (security)1:2.1.7-7+deb7u1fixed
jessie (security), jessie1:2.2.13-12~deb8u3fixed
stretch1:2.2.27-3+deb9u1fixed
buster1:2.2.32-2fixed
sid1:2.2.33.1-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
cyrus-imapd-2.2source(unstable)2.2.13-17medium547947
cyrus-imapd-2.2sourceetch2.2.13-10+etch4highDSA-1893-1
cyrus-imapd-2.2sourcelenny2.2.13-14+lenny3highDSA-1893-1
dovecotsource(unstable)1:1.2.1-1medium546656
dovecotsourceetch1.0.rc15-2etch5highDSA-1892-1
dovecotsourcelenny1:1.0.15-2.3+lenny1highDSA-1892-1
kolab-cyrus-imapdsource(unstable)2.2.13-5.1medium547712
kolab-cyrus-imapdsourceetch2.2.13-2+etch2highDSA-1893-1
kolab-cyrus-imapdsourcelenny2.2.13-5+lenny2highDSA-1893-1

Notes

This is a different vulnerability than CVE-2009-2632, it covers a few additional buffer overflows

Search for package or bug name: Reporting problems