CVE-2017-14230

Critical

Published: 10/09/2017(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

In the mboxlist_do_find function in Cyrus IMAP before version 3.0.4, an off-by-one error in prefix calculation for the LIST command led to the use of uninitialized memory. This may allow remote attackers to obtain sensitive information or cause a daemon crash.

Risk Assessment

The organization may be exposed to sensitive data leakage or denial of service attacks, potentially leading to service downtime.

Recommendation

It is recommended to upgrade to Cyrus IMAP version 3.0.4 or later to mitigate this vulnerability.

Original NVD description (English source)

In the mboxlist_do_find function in imap/mboxlist.c in Cyrus IMAP before 3.0.4, an off-by-one error in prefix calculation for the LIST command caused use of uninitialized memory, which might allow remote attackers to obtain sensitive information or cause a denial of service (daemon crash) via a 'LIST "" "Other Users"' command.