Vulnerability Details : CVE-2015-8077
Integer overflow in the index_urlfetch function in imap/index.c in Cyrus IMAP 2.3.19, 2.4.18, and 2.5.6 allows remote attackers to have unspecified impact via vectors related to urlfetch range checks and the start_octet variable. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-8076.
Vulnerability category: Overflow
Products affected by CVE-2015-8077
- cpe:2.3:a:cyrus:imap:2.3.0:*:*:*:*:*:*:*
- cpe:2.3:a:cyrus:imap:2.3.1:*:*:*:*:*:*:*
- cpe:2.3:a:cyrus:imap:2.3.8:*:*:*:*:*:*:*
- cpe:2.3:a:cyrus:imap:2.3.9:*:*:*:*:*:*:*
- cpe:2.3:a:cyrus:imap:2.3.16:*:*:*:*:*:*:*
- cpe:2.3:a:cyrus:imap:2.3.17:*:*:*:*:*:*:*
- cpe:2.3:a:cyrus:imap:2.4.6:*:*:*:*:*:*:*
- cpe:2.3:a:cyrus:imap:2.4.7:*:*:*:*:*:*:*
- cpe:2.3:a:cyrus:imap:2.4.14:*:*:*:*:*:*:*
- cpe:2.3:a:cyrus:imap:2.4.15:*:*:*:*:*:*:*
- cpe:2.3:a:cyrus:imap:2.3.6:*:*:*:*:*:*:*
- cpe:2.3:a:cyrus:imap:2.3.7:*:*:*:*:*:*:*
- cpe:2.3:a:cyrus:imap:2.3.14:*:*:*:*:*:*:*
- cpe:2.3:a:cyrus:imap:2.3.15:*:*:*:*:*:*:*
- cpe:2.3:a:cyrus:imap:2.4.4:*:*:*:*:*:*:*
- cpe:2.3:a:cyrus:imap:2.4.5:*:*:*:*:*:*:*
- cpe:2.3:a:cyrus:imap:2.4.12:*:*:*:*:*:*:*
- cpe:2.3:a:cyrus:imap:2.4.13:*:*:*:*:*:*:*
- cpe:2.3:a:cyrus:imap:2.5.2:*:*:*:*:*:*:*
- cpe:2.3:a:cyrus:imap:2.5.3:*:*:*:*:*:*:*
- cpe:2.3:a:cyrus:imap:2.3.4:*:*:*:*:*:*:*
- cpe:2.3:a:cyrus:imap:2.3.5:*:*:*:*:*:*:*
- cpe:2.3:a:cyrus:imap:2.3.12:*:*:*:*:*:*:*
- cpe:2.3:a:cyrus:imap:2.3.13:*:*:*:*:*:*:*
- cpe:2.3:a:cyrus:imap:2.4.1:*:*:*:*:*:*:*
- cpe:2.3:a:cyrus:imap:2.4.2:*:*:*:*:*:*:*
- cpe:2.3:a:cyrus:imap:2.4.3:*:*:*:*:*:*:*
- cpe:2.3:a:cyrus:imap:2.4.10:*:*:*:*:*:*:*
- cpe:2.3:a:cyrus:imap:2.4.11:*:*:*:*:*:*:*
- cpe:2.3:a:cyrus:imap:2.5.0:*:*:*:*:*:*:*
- cpe:2.3:a:cyrus:imap:2.5.1:*:*:*:*:*:*:*
- cpe:2.3:a:cyrus:imap:2.3.2:*:*:*:*:*:*:*
- cpe:2.3:a:cyrus:imap:2.3.3:*:*:*:*:*:*:*
- cpe:2.3:a:cyrus:imap:2.3.10:*:*:*:*:*:*:*
- cpe:2.3:a:cyrus:imap:2.3.11:*:*:*:*:*:*:*
- cpe:2.3:a:cyrus:imap:2.3.18:*:*:*:*:*:*:*
- cpe:2.3:a:cyrus:imap:2.4.0:*:*:*:*:*:*:*
- cpe:2.3:a:cyrus:imap:2.4.8:*:*:*:*:*:*:*
- cpe:2.3:a:cyrus:imap:2.4.9:*:*:*:*:*:*:*
- cpe:2.3:a:cyrus:imap:2.4.16:*:*:*:*:*:*:*
- cpe:2.3:a:cyrus:imap:2.4.17:*:*:*:*:*:*:*
- cpe:2.3:o:opensuse:opensuse:13.2:*:*:*:*:*:*:*
- cpe:2.3:o:opensuse:leap:42.1:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2015-8077
1.45%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 86 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2015-8077
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
7.5
|
HIGH | AV:N/AC:L/Au:N/C:P/I:P/A:P |
10.0
|
6.4
|
NIST |
CWE ids for CVE-2015-8077
-
Assigned by: nvd@nist.gov (Primary)
References for CVE-2015-8077
-
https://cyrus.foundation/cyrus-imapd/commit/?id=745e161c834f1eb6d62fc14477f51dae799e1e08
Cyrus Foundation – Cyrus IMap Git Repositories
-
https://docs.cyrus.foundation/imap/release-notes/2.5/x/2.5.7.html
Vendor Advisory
-
http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00066.html
[security-announce] SUSE-SU-2016:1457-1: important: Security update for
-
http://www.openwall.com/lists/oss-security/2015/11/04/3
oss-security - Re: CVE request: urlfetch range handling flaw in Cyrus IMAP
-
https://lists.andrew.cmu.edu/pipermail/cyrus-devel/2015-October/003534.html
Recent security fixes
-
http://lists.opensuse.org/opensuse-updates/2015-11/msg00156.html
openSUSE-SU-2015:2130-1: moderate: cyrus-imapd
-
http://www.openwall.com/lists/oss-security/2015/09/30/3
oss-security - Re: CVE request: urlfetch range handling flaw in Cyrus IMAP
-
http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00000.html
[security-announce] SUSE-SU-2016:1459-1: important: Security update for
-
http://lists.opensuse.org/opensuse-updates/2015-12/msg00015.html
openSUSE-SU-2015:2200-1: moderate: Security update for cyrus-imapd
-
http://www.securitytracker.com/id/1034282
Cyrus IMAP Server Integer Overflows Have Unspecified Impact - SecurityTracker
Jump to