Multiple buffer overflows in the CMU Cyrus SASL library before 2.1.23 might allow remote attackers to execute arbitrary code or cause a denial of service (application crash) via strings that are used as input to the sasl_encode64 function in lib/saslutil.c.
CVSS Details
- CVSS 3.1 Base Score: 7.3
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Apple Osx Cyrussasl | — | Apply OS X security update 2010-002 | Dec 16, 2011 | May 15, 2009 |
| Centos_linux | — | Upgrade cyrus-imapdUpgrade cyrus-imapd-perlUpgrade cyrus-imapd-develUpgrade cyrus-imapd-utils | Dec 1, 2016 | May 15, 2009 |
| Debian | — | Upgrade cyrus-sasl2 | Jul 30, 2024 | May 15, 2009 |
| Freebsd | — | Upgrade cyrus-sasl | Dec 10, 2025 | May 15, 2009 |
| Gentoo Linux | — | Upgrade dev-libs/cyrus-sasl. | Oct 30, 2017 | May 15, 2009 |
| Oracle_linux | — | Upgrade cyrus-imapd-develUpgrade cyrus-imapd-perlUpgrade cyrus-imapdUpgrade cyrus-imapd-utils | Oct 16, 2024 | May 15, 2009 |
| Suse | — | Upgrade cyrus-sasl-digestmd5-32bitUpgrade cyrus-sasl-otp-x86Upgrade cyrus-sasl-crammd5-x86Upgrade cyrus-sasl-ntlmUpgrade libsasl2-3-32bitUpgrade cyrus-sasl-otpUpgrade cyrus-sasl-ldap-auxpropUpgrade cyrus-sasl-crammd5Upgrade cyrus-sasl-gssapi-x86Upgrade cyrus-sasl-plainUpgrade cyrus-sasl-gs2Upgrade cyrus-sasl-otp-32bitUpgrade cyrus-saslUpgrade libsasl2-3Upgrade cyrus-sasl-plain-x86Upgrade cyrus-sasl-sqlauxpropUpgrade cyrus-sasl-plain-32bitUpgrade cyrus-sasl-crammd5-32bitUpgrade cyrus-sasl-develUpgrade cyrus-sasl-x86Upgrade cyrus-sasl-digestmd5Upgrade cyrus-sasl-sqlauxprop-32bitUpgrade cyrus-sasl-scramUpgrade cyrus-sasl-gssapiUpgrade cyrus-sasl-32bitUpgrade cyrus-sasl-saslauthdUpgrade cyrus-sasl-gssapi-32bit | Feb 17, 2015 | Jun 28, 2013 |
| Ubuntu | — | Upgrade libsasl2-2Upgrade libsasl2 | Nov 8, 2024 | May 15, 2009 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub