CVE-2005-2933 — Failure to Sanitize Paired Delimiters in Uw-imap

CWE-157 — Failure to Sanitize Paired Delimiters19 documents7 sources
Severity
7.5HIGHNVD
EPSS
35.1%
top 2.96%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
University OF Washington Uw-imapDebian AlpineDebian Uw-imap
Timeline
PublishedOct 13
Latest updateMay 3

Description

Buffer overflow in the mail_valid_net_parse_work function in mail.c for Washington's IMAP Server (UW-IMAP) before imap-2004g allows remote attackers to execute arbitrary code via a mailbox name containing a single double-quote (") character without a closing quote, which causes bytes after the double-quote to be copied into a buffer indefinitely.

CVSS vector

AV:N/AC:L/C:P/I:P/A:PExploitability: 10.0 | Impact: 6.4

Affected Packages4 packages

▶Debianuniversity_of_washington/uw-imap< 7:2002edebian1-12+1
▶debiandebian/uw-imap< uw-imap 7:2002edebian1-12 (bookworm)
▶debiandebian/alpine< uw-imap 7:2002edebian1-12 (bookworm)

Patches

Patch: archives.neohapsis.com ↗Patch: secunia.com ↗Patch: www.idefense.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-g3w5-6ccf-62gj: Buffer overflow in the mail_valid_net_parse_work function in mail↗2022-05-03
▶
OSV
CVE-2005-2933: Buffer overflow in the mail_valid_net_parse_work function in mail↗2005-10-13
▶

📋Vendor Advisories

3
Red Hat
Firefox command line URL launches multi-tabs↗2008-07-15
▶
Red Hat
security flaw↗2005-10-04
▶
Debian
CVE-2005-2933: alpine - Buffer overflow in the mail_valid_net_parse_work function in mail.c for Washingt...↗2005
▶

📐Framework References

1
CWE
Failure to Sanitize Paired Delimiters↗
▶

💬Community

11
Bugzilla
CVE-2005-2933 security flaw↗2018-08-16
▶
Bugzilla
CVE-2005-3388 multiple PHP issues (CVE-2006-1990 CVE-2005-3389 CVE-2005-3390)↗2006-06-19
▶
Bugzilla
CVE-2005-2933 imap buffer overflow↗2006-05-03
▶
Bugzilla
CVE-2005-2933 imap buffer overflow↗2006-05-03
▶
Bugzilla
CAN-2005-2933 imap buffer overflow (in libc-client)↗2006-03-06
▶