CVE-2008-5514
published 2008-12-23CVE-2008-5514: Off-by-one error in the rfc822_output_char function in the RFC822BUFFER routines in the University of Washington (UW) c-client library, as used by the UW IMAP…
PriorityP415medium4.3CVSS 2.0
AVNACMAuNCNINAP
EPSS
1.76%
75.3th percentile
Off-by-one error in the rfc822_output_char function in the RFC822BUFFER routines in the University of Washington (UW) c-client library, as used by the UW IMAP toolkit before imap-2007e and other applications, allows context-dependent attackers to cause a denial of service (crash) via an e-mail message that triggers a buffer overflow.
Affected
43 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| alpine_project | alpine | >= 0 < 2.02-3.1 | 2.02-3.1 |
| alpine_project | alpine | >= 0 < 2.02-3.1 | 2.02-3.1 |
| alpine_project | alpine | >= 0 < 2.02-3.1 | 2.02-3.1 |
| alpine_project | alpine | >= 0 < 2.02-3.1 | 2.02-3.1 |
| debian | alpine | < alpine 2.02-3.1 (bookworm) | alpine 2.02-3.1 (bookworm) |
| debian | uw-imap | < alpine 2.02-3.1 (bookworm) | alpine 2.02-3.1 (bookworm) |
| university_of_washington | imap | <= 2007d | — |
| university_of_washington | imap | — | — |
| university_of_washington | imap | — | — |
| university_of_washington | imap | — | — |
| university_of_washington | imap | — | — |
| university_of_washington | imap | — | — |
| university_of_washington | imap | — | — |
| university_of_washington | imap | — | — |
| university_of_washington | imap | — | — |
| university_of_washington | imap | — | — |
| university_of_washington | imap | — | — |
| university_of_washington | imap | — | — |
| university_of_washington | imap | — | — |
| university_of_washington | imap | — | — |
| university_of_washington | imap | — | — |
| university_of_washington | imap | — | — |
| university_of_washington | imap | — | — |
| university_of_washington | imap | — | — |
| university_of_washington | imap | — | — |
CVSS provenance
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:N/A:P
osv4.3MEDIUM
vendor_debian4.3LOW
vendor_redhat4.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-9m53-2xrc-rq26: Off-by-one error in the rfc822_output_char function in the RFC822BUFFER routines in the University of Washington (UW) c-client library, as used by the
ghsa_unreviewed·2022-05-17
CVE-2008-5514 [MEDIUM] CWE-119 GHSA-9m53-2xrc-rq26: Off-by-one error in the rfc822_output_char function in the RFC822BUFFER routines in the University of Washington (UW) c-client library, as used by the
Off-by-one error in the rfc822_output_char function in the RFC822BUFFER routines in the University of Washington (UW) c-client library, as used by the UW IMAP toolkit before imap-2007e and other applications, allows context-dependent attackers to cause a denial of service (crash) via an e-mail message that triggers a buffer overflow.
OSV
CVE-2008-5514: Off-by-one error in the rfc822_output_char function in the RFC822BUFFER routines in the University of Washington (UW) c-client library, as used by the
osv·2008-12-23·CVSS 4.3
CVE-2008-5514 [MEDIUM] CVE-2008-5514: Off-by-one error in the rfc822_output_char function in the RFC822BUFFER routines in the University of Washington (UW) c-client library, as used by the
Off-by-one error in the rfc822_output_char function in the RFC822BUFFER routines in the University of Washington (UW) c-client library, as used by the UW IMAP toolkit before imap-2007e and other applications, allows context-dependent attackers to cause a denial of service (crash) via an e-mail message that triggers a buffer overflow.
Red Hat
libc-client: buffer overflow in rfc822_output_char / rfc822_output_data
vendor_redhat·2008-12-15·CVSS 4.3
CVE-2008-5514 [MEDIUM] libc-client: buffer overflow in rfc822_output_char / rfc822_output_data
libc-client: buffer overflow in rfc822_output_char / rfc822_output_data
Off-by-one error in the rfc822_output_char function in the RFC822BUFFER routines in the University of Washington (UW) c-client library, as used by the UW IMAP toolkit before imap-2007e and other applications, allows context-dependent attackers to cause a denial of service (crash) via an e-mail message that triggers a buffer overflow.
Statement: Not vulnerable. This issue did not affect the versions of imap as shipped with Red Hat Enterprise Linux 2.1 and 3, and the versions of libc-client as shipped with Red Hat Enterprise Linux 4 and 5.
Debian
CVE-2008-5514: alpine - Off-by-one error in the rfc822_output_char function in the RFC822BUFFER routines...
vendor_debian·2008·CVSS 4.3
CVE-2008-5514 [MEDIUM] CVE-2008-5514: alpine - Off-by-one error in the rfc822_output_char function in the RFC822BUFFER routines...
Off-by-one error in the rfc822_output_char function in the RFC822BUFFER routines in the University of Washington (UW) c-client library, as used by the UW IMAP toolkit before imap-2007e and other applications, allows context-dependent attackers to cause a denial of service (crash) via an e-mail message that triggers a buffer overflow.
Scope: local
bookworm: resolved (fixed in 2.02-3.1)
bullseye: resolved (fixed in 2.02-3.1)
forky: resolved (fixed in 2.02-3.1)
sid: resolved (fixed in 2.02-3.1)
trixie: resolved (fixed in 2.02-3.1)
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2008-5514 libc-client: buffer overflow in rfc822_output_char / rfc822_output_data [fedora-all]
bugzilla·2011-12-26·CVSS 4.3
CVE-2008-5514 [MEDIUM] CVE-2008-5514 libc-client: buffer overflow in rfc822_output_char / rfc822_output_data [fedora-all]
CVE-2008-5514 libc-client: buffer overflow in rfc822_output_char / rfc822_output_data [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected Fedora
versions.
For comments that are specific to the vulnerability please use bugs filed
against "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When creating a Bodhi update request, please include this bug ID and the
bug IDs of this bug's parent bugs filed against the "Security Response"
product (the top-level CVE bugs). Please mention the CVE IDs being fixed
in the RPM changelog when available.
Bodhi update submission link:
https://admin.fedoraproject.org/upda
Bugzilla
CVE-2008-5514 libc-client: buffer overflow in rfc822_output_char / rfc822_output_data [epel-all]
bugzilla·2011-12-26·CVSS 4.3
CVE-2008-5514 [MEDIUM] CVE-2008-5514 libc-client: buffer overflow in rfc822_output_char / rfc822_output_data [epel-all]
CVE-2008-5514 libc-client: buffer overflow in rfc822_output_char / rfc822_output_data [epel-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected Fedora
versions.
For comments that are specific to the vulnerability please use bugs filed
against "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When creating a Bodhi update request, please include this bug ID and the
bug IDs of this bug's parent bugs filed against the "Security Response"
product (the top-level CVE bugs). Please mention the CVE IDs being fixed
in the RPM changelog when available.
Bodhi update submission link:
https://admin.fedoraproject.org/update
Bugzilla
CVE-2008-5514 libc-client: buffer overflow in rfc822_output_char / rfc822_output_data
bugzilla·2008-12-19·CVSS 4.3
CVE-2008-5514 [MEDIUM] CVE-2008-5514 libc-client: buffer overflow in rfc822_output_char / rfc822_output_data
CVE-2008-5514 libc-client: buffer overflow in rfc822_output_char / rfc822_output_data
Ludwig Nussel reported a flaw in libc-client / uw-imap:
The rfc822_output_char() function in the uw-imap c-client library does not check whether the buffer is already full and may therefore write one byte too much. This leads to a segfault in rfc822_output_data() later due to memcpy with size -1.
Issue was fixed in imap-2007e:
Updated: 16 December 2008
imap-2007e is a maintenance release, consisting primarily of bugfixes to
problems discovered in the release that affected a small number of users
plus a security fix for users of the RFC822BUFFER routines.
Discussion:
Created attachment 327481
Upstream patch
---
imap/libc-client source code is also embedded in alpine sources. This issue was already
http://secunia.com/advisories/33275http://secunia.com/advisories/33638http://securitytracker.com/id?1021485http://www.mandriva.com/security/advisories?name=MDVSA-2009:146http://www.securityfocus.com/bid/32958http://www.vupen.com/english/advisories/2008/3490http://www.washington.edu/imap/documentation/RELNOTES.htmlhttps://bugzilla.redhat.com/show_bug.cgi?id=477227https://exchange.xforce.ibmcloud.com/vulnerabilities/47526https://www.redhat.com/archives/fedora-package-announce/2009-January/msg00846.htmlhttp://secunia.com/advisories/33275http://secunia.com/advisories/33638http://securitytracker.com/id?1021485http://www.mandriva.com/security/advisories?name=MDVSA-2009:146http://www.securityfocus.com/bid/32958http://www.vupen.com/english/advisories/2008/3490http://www.washington.edu/imap/documentation/RELNOTES.htmlhttps://bugzilla.redhat.com/show_bug.cgi?id=477227https://exchange.xforce.ibmcloud.com/vulnerabilities/47526https://www.redhat.com/archives/fedora-package-announce/2009-January/msg00846.html
2008-12-23
Published