CVE-2022-4121

NameCVE-2022-4121
DescriptionIn libetpan a null pointer dereference in mailimap_mailbox_data_status_free in low-level/imap/mailimap_types.c was found that could lead to a remote denial of service or other potential consequences.
SourceCVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDLA-3261-1, DLA-4256-1
Debian Bugs1025120

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
libetpan (PTS)bullseye1.9.4-3vulnerable
bullseye (security)1.9.4-3+deb11u1fixed
bookworm1.9.4-3.1fixed
forky, sid, trixie1.9.4-6fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
libetpansourcebuster1.9.3-2+deb10u2DLA-3261-1
libetpansourcebullseye1.9.4-3+deb11u1DLA-4256-1
libetpansource(unstable)1.9.4-3.11025120

Notes

https://github.com/dinhvh/libetpan/issues/420
https://github.com/dinhvh/libetpan/commit/5c9eb6b6ba64c4eb927d7a902317410181aacbba
Search for package or bug name: Reporting problems