rpm package
opensuse/isync&distro=openSUSE Tumbleweed
pkg:rpm/opensuse/isync&distro=openSUSE%20Tumbleweed
Vulnerabilities (4)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2021-3657 | Cri | 9.8 | < 1.4.4-1.1 | 1.4.4-1.1 | Feb 18, 2022 | A flaw was found in mbsync versions prior to 1.4.4. Due to inadequate handling of extremely large (>=2GiB) IMAP literals, malicious or compromised IMAP servers, and hypothetically even external email senders, could cause several different buffer overflows, which could conceivably | |
| CVE-2021-3578 | Hig | 7.8 | < 1.4.3-1.2 | 1.4.3-1.2 | Feb 16, 2022 | A flaw was found in mbsync before v1.3.6 and v1.4.2, where an unchecked pointer cast allows a malicious or compromised server to write an arbitrary integer value past the end of a heap-allocated structure by issuing an unexpected APPENDUID response. This could be plausibly exploi | |
| CVE-2021-44143 | Cri | 9.8 | < 1.4.4-1.1 | 1.4.4-1.1 | Nov 22, 2021 | A flaw was found in mbsync in isync 1.4.0 through 1.4.3. Due to an unchecked condition, a malicious or compromised IMAP server could use a crafted mail message that lacks headers (i.e., one that starts with an empty line) to provoke a heap overflow, which could conceivably be exp | |
| CVE-2021-20247 | Hig | 7.4 | < 1.4.3-1.2 | 1.4.3-1.2 | Feb 23, 2021 | A flaw was found in mbsync before v1.3.5 and v1.4.1. Validations of the mailbox names returned by IMAP LIST/LSUB do not occur allowing a malicious or compromised server to use specially crafted mailbox names containing '..' path components to access data outside the designated ma |
- affected < 1.4.4-1.1fixed 1.4.4-1.1
A flaw was found in mbsync versions prior to 1.4.4. Due to inadequate handling of extremely large (>=2GiB) IMAP literals, malicious or compromised IMAP servers, and hypothetically even external email senders, could cause several different buffer overflows, which could conceivably
- affected < 1.4.3-1.2fixed 1.4.3-1.2
A flaw was found in mbsync before v1.3.6 and v1.4.2, where an unchecked pointer cast allows a malicious or compromised server to write an arbitrary integer value past the end of a heap-allocated structure by issuing an unexpected APPENDUID response. This could be plausibly exploi
- affected < 1.4.4-1.1fixed 1.4.4-1.1
A flaw was found in mbsync in isync 1.4.0 through 1.4.3. Due to an unchecked condition, a malicious or compromised IMAP server could use a crafted mail message that lacks headers (i.e., one that starts with an empty line) to provoke a heap overflow, which could conceivably be exp
- affected < 1.4.3-1.2fixed 1.4.3-1.2
A flaw was found in mbsync before v1.3.5 and v1.4.1. Validations of the mailbox names returned by IMAP LIST/LSUB do not occur allowing a malicious or compromised server to use specially crafted mailbox names containing '..' path components to access data outside the designated ma