FreshPorts - VuXML

This page displays vulnerability information about FreeBSD Ports.

The VUXML data was last processed by FreshPorts on 2024-09-18 07:05:22 UTC

List all Vulnerabilities, by package

List all Vulnerabilities, by date

k68

These are the vulnerabilities relating to the commit you have selected:

VuXML IDDescription
14908bda-232b-11ef-b621-00155d645102cyrus-imapd -- unbounded memory allocation

Cyrus IMAP 3.8.3 Release Notes states:

Fixed CVE-2024-34055: Cyrus-IMAP through 3.8.2 and 3.10.0-beta2 allow authenticated attackers to cause unbounded memory allocation by sending many LITERALs in a single command.

The IMAP protocol allows for command arguments to be LITERALs of negotiated length, and for these the server allocates memory to receive the content before instructing the client to proceed. The allocated memory is released when the whole command has been received and processed.

The IMAP protocol has a number commands that specify an unlimited number of arguments, for example SEARCH. Each of these arguments can be a LITERAL, for which memory will be allocated and not released until the entire command has been received and processed. This can run a server out of memory, with varying consequences depending on the server's OOM policy.


Discovery 2024-04-30
Entry 2024-06-05
cyrus-imapd38
< 3.8.2_1

cyrus-imapd36
< 3.6.4_1

cyrus-imapd34
< 3.4.7_1

cyrus-imapd32
cyrus-imapd30
cyrus-imapd25
> 0

CVE-2024-34055
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-34055