Vulnerability-Lookup

CVE-2009-3235 (GCVE-0-2009-3235)

Vulnerability from cvelistv5 – Published: 2009-09-17 10:00 – Updated: 2024-08-07 06:22

Summary

Multiple stack-based buffer overflows in the Sieve plugin in Dovecot 1.0 before 1.0.4 and 1.1 before 1.1.7, as derived from Cyrus libsieve, allow context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted SIEVE script, as demonstrated by forwarding an e-mail message to a large number of recipients, a different vulnerability than CVE-2009-2632.

Severity

No CVSS data available.

CWE

Assigner

mitre CNA under the mitre root

CNA scorecard E 28/100 over 2319 records in the last 180 days details

References

17 references

URL	Tags
http://www.securityfocus.com/bid/36377	vdb-entryx_refsource_BID
https://exchange.xforce.ibmcloud.com/vulnerabilit…	vdb-entryx_refsource_XF
http://secunia.com/advisories/36713	third-party-advisoryx_refsource_SECUNIA
http://lists.opensuse.org/opensuse-security-annou…	vendor-advisoryx_refsource_SUSE
http://dovecot.org/list/dovecot-news/2009-Septemb…	mailing-listx_refsource_MLIST
http://www.ubuntu.com/usn/USN-838-1	vendor-advisoryx_refsource_UBUNTU
http://www.osvdb.org/58103	vdb-entryx_refsource_OSVDB
https://oval.cisecurity.org/repository/search/def…	vdb-entrysignaturex_refsource_OVAL
http://www.vupen.com/english/advisories/2009/3184	vdb-entryx_refsource_VUPEN
http://lists.opensuse.org/opensuse-security-annou…	vendor-advisoryx_refsource_SUSE
http://secunia.com/advisories/36904	third-party-advisoryx_refsource_SECUNIA
http://secunia.com/advisories/36698	third-party-advisoryx_refsource_SECUNIA
http://www.vupen.com/english/advisories/2009/2641	vdb-entryx_refsource_VUPEN
http://lists.apple.com/archives/security-announce…	vendor-advisoryx_refsource_APPLE
https://www.redhat.com/archives/fedora-package-an…	vendor-advisoryx_refsource_FEDORA
http://www.openwall.com/lists/oss-security/2009/09/14/3	mailing-listx_refsource_MLIST
http://support.apple.com/kb/HT3937	x_refsource_CONFIRM

Date Public

2009-09-14 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T06:22:23.176Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "36377",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/36377"
          },
          {
            "name": "cmu-sieve-dovecot-unspecified-bo(53248)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/53248"
          },
          {
            "name": "36713",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/36713"
          },
          {
            "name": "SUSE-SR:2009:018",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2009-11/msg00004.html"
          },
          {
            "name": "[Dovecot-news] 20090914 Security holes in CMU Sieve plugin",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://dovecot.org/list/dovecot-news/2009-September/000135.html"
          },
          {
            "name": "USN-838-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "http://www.ubuntu.com/usn/USN-838-1"
          },
          {
            "name": "58103",
            "tags": [
              "vdb-entry",
              "x_refsource_OSVDB",
              "x_transferred"
            ],
            "url": "http://www.osvdb.org/58103"
          },
          {
            "name": "oval:org.mitre.oval:def:10515",
            "tags": [
              "vdb-entry",
              "signature",
              "x_refsource_OVAL",
              "x_transferred"
            ],
            "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10515"
          },
          {
            "name": "ADV-2009-3184",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2009/3184"
          },
          {
            "name": "SUSE-SR:2009:016",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00001.html"
          },
          {
            "name": "36904",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/36904"
          },
          {
            "name": "36698",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/36698"
          },
          {
            "name": "ADV-2009-2641",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2009/2641"
          },
          {
            "name": "APPLE-SA-2009-11-09-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_APPLE",
              "x_transferred"
            ],
            "url": "http://lists.apple.com/archives/security-announce/2009/Nov/msg00000.html"
          },
          {
            "name": "FEDORA-2009-9559",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://www.redhat.com/archives/fedora-package-announce/2009-September/msg00491.html"
          },
          {
            "name": "[oss-security] 20090914 Re: CVE for recent cyrus-imap issue",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2009/09/14/3"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://support.apple.com/kb/HT3937"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2009-09-14T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Multiple stack-based buffer overflows in the Sieve plugin in Dovecot 1.0 before 1.0.4 and 1.1 before 1.1.7, as derived from Cyrus libsieve, allow context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted SIEVE script, as demonstrated by forwarding an e-mail message to a large number of recipients, a different vulnerability than CVE-2009-2632."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-09-18T12:57:01.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "36377",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/36377"
        },
        {
          "name": "cmu-sieve-dovecot-unspecified-bo(53248)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/53248"
        },
        {
          "name": "36713",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/36713"
        },
        {
          "name": "SUSE-SR:2009:018",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2009-11/msg00004.html"
        },
        {
          "name": "[Dovecot-news] 20090914 Security holes in CMU Sieve plugin",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://dovecot.org/list/dovecot-news/2009-September/000135.html"
        },
        {
          "name": "USN-838-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "http://www.ubuntu.com/usn/USN-838-1"
        },
        {
          "name": "58103",
          "tags": [
            "vdb-entry",
            "x_refsource_OSVDB"
          ],
          "url": "http://www.osvdb.org/58103"
        },
        {
          "name": "oval:org.mitre.oval:def:10515",
          "tags": [
            "vdb-entry",
            "signature",
            "x_refsource_OVAL"
          ],
          "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10515"
        },
        {
          "name": "ADV-2009-3184",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2009/3184"
        },
        {
          "name": "SUSE-SR:2009:016",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00001.html"
        },
        {
          "name": "36904",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/36904"
        },
        {
          "name": "36698",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/36698"
        },
        {
          "name": "ADV-2009-2641",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2009/2641"
        },
        {
          "name": "APPLE-SA-2009-11-09-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_APPLE"
          ],
          "url": "http://lists.apple.com/archives/security-announce/2009/Nov/msg00000.html"
        },
        {
          "name": "FEDORA-2009-9559",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://www.redhat.com/archives/fedora-package-announce/2009-September/msg00491.html"
        },
        {
          "name": "[oss-security] 20090914 Re: CVE for recent cyrus-imap issue",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2009/09/14/3"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://support.apple.com/kb/HT3937"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2009-3235",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Multiple stack-based buffer overflows in the Sieve plugin in Dovecot 1.0 before 1.0.4 and 1.1 before 1.1.7, as derived from Cyrus libsieve, allow context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted SIEVE script, as demonstrated by forwarding an e-mail message to a large number of recipients, a different vulnerability than CVE-2009-2632."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "36377",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/36377"
            },
            {
              "name": "cmu-sieve-dovecot-unspecified-bo(53248)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/53248"
            },
            {
              "name": "36713",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/36713"
            },
            {
              "name": "SUSE-SR:2009:018",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2009-11/msg00004.html"
            },
            {
              "name": "[Dovecot-news] 20090914 Security holes in CMU Sieve plugin",
              "refsource": "MLIST",
              "url": "http://dovecot.org/list/dovecot-news/2009-September/000135.html"
            },
            {
              "name": "USN-838-1",
              "refsource": "UBUNTU",
              "url": "http://www.ubuntu.com/usn/USN-838-1"
            },
            {
              "name": "58103",
              "refsource": "OSVDB",
              "url": "http://www.osvdb.org/58103"
            },
            {
              "name": "oval:org.mitre.oval:def:10515",
              "refsource": "OVAL",
              "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10515"
            },
            {
              "name": "ADV-2009-3184",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2009/3184"
            },
            {
              "name": "SUSE-SR:2009:016",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00001.html"
            },
            {
              "name": "36904",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/36904"
            },
            {
              "name": "36698",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/36698"
            },
            {
              "name": "ADV-2009-2641",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2009/2641"
            },
            {
              "name": "APPLE-SA-2009-11-09-1",
              "refsource": "APPLE",
              "url": "http://lists.apple.com/archives/security-announce/2009/Nov/msg00000.html"
            },
            {
              "name": "FEDORA-2009-9559",
              "refsource": "FEDORA",
              "url": "https://www.redhat.com/archives/fedora-package-announce/2009-September/msg00491.html"
            },
            {
              "name": "[oss-security] 20090914 Re: CVE for recent cyrus-imap issue",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2009/09/14/3"
            },
            {
              "name": "http://support.apple.com/kb/HT3937",
              "refsource": "CONFIRM",
              "url": "http://support.apple.com/kb/HT3937"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2009-3235",
    "datePublished": "2009-09-17T10:00:00.000Z",
    "dateReserved": "2009-09-16T00:00:00.000Z",
    "dateUpdated": "2024-08-07T06:22:23.176Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2009-3235",
      "date": "2026-10-14",
      "epss": "0.0404",
      "percentile": "0.90456"
    },
    "nvd": {
      "cve": {
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:dovecot:dovecot:1.0:*:*:*:*:*:*:*",
                    "matchCriteriaId": "4240BD98-3C31-42CE-AF8F-045DD4BFC084",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:dovecot:dovecot:1.0.1:*:*:*:*:*:*:*",
                    "matchCriteriaId": "4D7A4A82-6C8D-453E-ACC5-2C8BAC7804D6",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:dovecot:dovecot:1.0.2:*:*:*:*:*:*:*",
                    "matchCriteriaId": "1C05ACA0-ED87-4DDF-94B6-8D25BE1790F1",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:dovecot:dovecot:1.0.3:*:*:*:*:*:*:*",
                    "matchCriteriaId": "8A8C0C4A-F9DB-4BB7-BFC5-BEC22C3FE40B",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:dovecot:dovecot:1.1:*:*:*:*:*:*:*",
                    "matchCriteriaId": "F8BE860F-A3C2-43E0-BC75-503C437DAADD",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:dovecot:dovecot:1.1.0:*:*:*:*:*:*:*",
                    "matchCriteriaId": "E4E57B06-8650-4374-B643-6FCBE3ABDAF5",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:dovecot:dovecot:1.1.1:*:*:*:*:*:*:*",
                    "matchCriteriaId": "B0384E42-1506-4C08-AA5A-18B2A711C7F0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:dovecot:dovecot:1.1.2:*:*:*:*:*:*:*",
                    "matchCriteriaId": "F5DC1CE5-50B9-426E-B98A-224DC499AB15",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:dovecot:dovecot:1.1.3:*:*:*:*:*:*:*",
                    "matchCriteriaId": "350A26D6-A8BA-4125-A640-264E08D28CB0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:dovecot:dovecot:1.1.4:*:*:*:*:*:*:*",
                    "matchCriteriaId": "71057F4B-3040-4771-B989-9F3453934AAA",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:dovecot:dovecot:1.1.5:*:*:*:*:*:*:*",
                    "matchCriteriaId": "1730EBB1-4071-4A23-B770-D564AF422273",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:dovecot:dovecot:1.1.6:*:*:*:*:*:*:*",
                    "matchCriteriaId": "10A27394-E1C7-4EF0-94C8-71D6EA33CE6D",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Multiple stack-based buffer overflows in the Sieve plugin in Dovecot 1.0 before 1.0.4 and 1.1 before 1.1.7, as derived from Cyrus libsieve, allow context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted SIEVE script, as demonstrated by forwarding an e-mail message to a large number of recipients, a different vulnerability than CVE-2009-2632."
          },
          {
            "lang": "es",
            "value": "M\u00faltiples desbordamientos de b\u00fafer basados en pila en el complemento -plugin- Sieve de Dovecot v1.0 anterior a v1.0.4 y v1.1 anterior a v1.1.7, como se deriva de Cyrus libsieve, permiten a atacantes dependientes del contexto provocar una denegaci\u00f3n de servicio (ca\u00edda) y puede que ejecutar c\u00f3digo de su elecci\u00f3n a trav\u00e9s de una secuencia de comandos SIEVE, como se ha demostrado reenviando un mensaje de correo a un gran n\u00famero de usuarios. Se trata de una vulnerabilidad diferente de CVE-2009-2632."
          }
        ],
        "id": "CVE-2009-3235",
        "lastModified": "2026-04-23T00:35:47.467",
        "metrics": {
          "cvssMetricV2": [
            {
              "acInsufInfo": false,
              "baseSeverity": "HIGH",
              "cvssData": {
                "accessComplexity": "LOW",
                "accessVector": "NETWORK",
                "authentication": "NONE",
                "availabilityImpact": "PARTIAL",
                "baseScore": 7.5,
                "confidentialityImpact": "PARTIAL",
                "integrityImpact": "PARTIAL",
                "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
                "version": "2.0"
              },
              "exploitabilityScore": 10.0,
              "impactScore": 6.4,
              "obtainAllPrivilege": false,
              "obtainOtherPrivilege": false,
              "obtainUserPrivilege": false,
              "source": "nvd@nist.gov",
              "type": "Primary",
              "userInteractionRequired": false
            }
          ]
        },
        "published": "2009-09-17T10:30:01.327",
        "references": [
          {
            "source": "cve@mitre.org",
            "tags": [
              "Patch",
              "Vendor Advisory"
            ],
            "url": "http://dovecot.org/list/dovecot-news/2009-September/000135.html"
          },
          {
            "source": "cve@mitre.org",
            "url": "http://lists.apple.com/archives/security-announce/2009/Nov/msg00000.html"
          },
          {
            "source": "cve@mitre.org",
            "url": "http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00001.html"
          },
          {
            "source": "cve@mitre.org",
            "url": "http://lists.opensuse.org/opensuse-security-announce/2009-11/msg00004.html"
          },
          {
            "source": "cve@mitre.org",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "http://secunia.com/advisories/36698"
          },
          {
            "source": "cve@mitre.org",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "http://secunia.com/advisories/36713"
          },
          {
            "source": "cve@mitre.org",
            "url": "http://secunia.com/advisories/36904"
          },
          {
            "source": "cve@mitre.org",
            "url": "http://support.apple.com/kb/HT3937"
          },
          {
            "source": "cve@mitre.org",
            "url": "http://www.openwall.com/lists/oss-security/2009/09/14/3"
          },
          {
            "source": "cve@mitre.org",
            "url": "http://www.osvdb.org/58103"
          },
          {
            "source": "cve@mitre.org",
            "url": "http://www.securityfocus.com/bid/36377"
          },
          {
            "source": "cve@mitre.org",
            "url": "http://www.ubuntu.com/usn/USN-838-1"
          },
          {
            "source": "cve@mitre.org",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "http://www.vupen.com/english/advisories/2009/2641"
          },
          {
            "source": "cve@mitre.org",
            "url": "http://www.vupen.com/english/advisories/2009/3184"
          },
          {
            "source": "cve@mitre.org",
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/53248"
          },
          {
            "source": "cve@mitre.org",
            "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10515"
          },
          {
            "source": "cve@mitre.org",
            "tags": [
              "Patch"
            ],
            "url": "https://www.redhat.com/archives/fedora-package-announce/2009-September/msg00491.html"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch",
              "Vendor Advisory"
            ],
            "url": "http://dovecot.org/list/dovecot-news/2009-September/000135.html"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://lists.apple.com/archives/security-announce/2009/Nov/msg00000.html"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00001.html"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://lists.opensuse.org/opensuse-security-announce/2009-11/msg00004.html"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "http://secunia.com/advisories/36698"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "http://secunia.com/advisories/36713"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://secunia.com/advisories/36904"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://support.apple.com/kb/HT3937"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://www.openwall.com/lists/oss-security/2009/09/14/3"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://www.osvdb.org/58103"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://www.securityfocus.com/bid/36377"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://www.ubuntu.com/usn/USN-838-1"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "http://www.vupen.com/english/advisories/2009/2641"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://www.vupen.com/english/advisories/2009/3184"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/53248"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10515"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://www.redhat.com/archives/fedora-package-announce/2009-September/msg00491.html"
          }
        ],
        "sourceIdentifier": "cve@mitre.org",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-119"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Important",
      "current_release_date": "2025-11-21T13:10:34+00:00",
      "cve": "CVE-2009-3235",
      "id": "CVE-2009-3235",
      "initial_release_date": "2009-09-14T00:00:00+00:00",
      "product_status:fixed": "232",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "cyrus-impad: CMU sieve buffer overflows",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2009/cve-2009-3235.json",
      "version": "3"
    }
  }
}

CERTA-2009-AVI-487

Vulnerability from certfr_avis - Published: 2009-11-10 - Updated: 2009-11-10

De multiples vulnérabilités dans Apple MacOS X permettent entre autres l'exécution de code arbitraire à distance.

Description

L'éditeur Apple a publié un ensemble de correctifs pour les applications livrées avec son système d'exploitation Mac OS X. L'exploitation des vulnérabilités par une personne malintentionnée pourrait permettre, entre autres, l'exécution de code arbitraire à distance.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None

Impacted products

Vendor	Product	Description
Apple	macOS	Mac OS X 10.5 ;
Apple	macOS	Mac OS X 10.6 ;
Apple	macOS	Mac OS X Server 10.5 ;
Apple	macOS	Mac OS X Server 10.6.

References

Title

Publication Time

FKIE_CVE-2009-3235

Vulnerability from fkie_nvd - Published: 2009-09-17 10:30 - Updated: 2026-06-16 23:11

Severity

Summary

References

URL	Tags
cve@mitre.org	http://dovecot.org/list/dovecot-news/2009-September/000135.html	Patch, Vendor Advisory
cve@mitre.org	http://lists.apple.com/archives/security-announce/2009/Nov/msg00000.html
cve@mitre.org	http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00001.html
cve@mitre.org	http://lists.opensuse.org/opensuse-security-announce/2009-11/msg00004.html
cve@mitre.org	http://secunia.com/advisories/36698	Vendor Advisory
cve@mitre.org	http://secunia.com/advisories/36713	Vendor Advisory
cve@mitre.org	http://secunia.com/advisories/36904
cve@mitre.org	http://support.apple.com/kb/HT3937
cve@mitre.org	http://www.openwall.com/lists/oss-security/2009/09/14/3
cve@mitre.org	http://www.osvdb.org/58103
cve@mitre.org	http://www.securityfocus.com/bid/36377
cve@mitre.org	http://www.ubuntu.com/usn/USN-838-1
cve@mitre.org	http://www.vupen.com/english/advisories/2009/2641	Vendor Advisory
cve@mitre.org	http://www.vupen.com/english/advisories/2009/3184
cve@mitre.org	https://exchange.xforce.ibmcloud.com/vulnerabilities/53248
cve@mitre.org	https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10515
cve@mitre.org	https://www.redhat.com/archives/fedora-package-announce/2009-September/msg00491.html	Patch
af854a3a-2127-422b-91ae-364da2661108	http://dovecot.org/list/dovecot-news/2009-September/000135.html	Patch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108	http://lists.apple.com/archives/security-announce/2009/Nov/msg00000.html
af854a3a-2127-422b-91ae-364da2661108	http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00001.html
af854a3a-2127-422b-91ae-364da2661108	http://lists.opensuse.org/opensuse-security-announce/2009-11/msg00004.html
af854a3a-2127-422b-91ae-364da2661108	http://secunia.com/advisories/36698	Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108	http://secunia.com/advisories/36713	Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108	http://secunia.com/advisories/36904
af854a3a-2127-422b-91ae-364da2661108	http://support.apple.com/kb/HT3937
af854a3a-2127-422b-91ae-364da2661108	http://www.openwall.com/lists/oss-security/2009/09/14/3
af854a3a-2127-422b-91ae-364da2661108	http://www.osvdb.org/58103
af854a3a-2127-422b-91ae-364da2661108	http://www.securityfocus.com/bid/36377
af854a3a-2127-422b-91ae-364da2661108	http://www.ubuntu.com/usn/USN-838-1
af854a3a-2127-422b-91ae-364da2661108	http://www.vupen.com/english/advisories/2009/2641	Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108	http://www.vupen.com/english/advisories/2009/3184
af854a3a-2127-422b-91ae-364da2661108	https://exchange.xforce.ibmcloud.com/vulnerabilities/53248
af854a3a-2127-422b-91ae-364da2661108	https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10515
af854a3a-2127-422b-91ae-364da2661108	https://www.redhat.com/archives/fedora-package-announce/2009-September/msg00491.html	Patch

Impacted products

Vendor	Product	Version
dovecot	dovecot	1.0
dovecot	dovecot	1.0.1
dovecot	dovecot	1.0.2
dovecot	dovecot	1.0.3
dovecot	dovecot	1.1
dovecot	dovecot	1.1.0
dovecot	dovecot	1.1.1
dovecot	dovecot	1.1.2
dovecot	dovecot	1.1.3
dovecot	dovecot	1.1.4
dovecot	dovecot	1.1.5
dovecot	dovecot	1.1.6

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "source": "cve@mitre.org"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:dovecot:dovecot:1.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "4240BD98-3C31-42CE-AF8F-045DD4BFC084",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:dovecot:dovecot:1.0.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "4D7A4A82-6C8D-453E-ACC5-2C8BAC7804D6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:dovecot:dovecot:1.0.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "1C05ACA0-ED87-4DDF-94B6-8D25BE1790F1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:dovecot:dovecot:1.0.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "8A8C0C4A-F9DB-4BB7-BFC5-BEC22C3FE40B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:dovecot:dovecot:1.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "F8BE860F-A3C2-43E0-BC75-503C437DAADD",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:dovecot:dovecot:1.1.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "E4E57B06-8650-4374-B643-6FCBE3ABDAF5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:dovecot:dovecot:1.1.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "B0384E42-1506-4C08-AA5A-18B2A711C7F0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:dovecot:dovecot:1.1.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "F5DC1CE5-50B9-426E-B98A-224DC499AB15",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:dovecot:dovecot:1.1.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "350A26D6-A8BA-4125-A640-264E08D28CB0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:dovecot:dovecot:1.1.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "71057F4B-3040-4771-B989-9F3453934AAA",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:dovecot:dovecot:1.1.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "1730EBB1-4071-4A23-B770-D564AF422273",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:dovecot:dovecot:1.1.6:*:*:*:*:*:*:*",
              "matchCriteriaId": "10A27394-E1C7-4EF0-94C8-71D6EA33CE6D",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Multiple stack-based buffer overflows in the Sieve plugin in Dovecot 1.0 before 1.0.4 and 1.1 before 1.1.7, as derived from Cyrus libsieve, allow context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted SIEVE script, as demonstrated by forwarding an e-mail message to a large number of recipients, a different vulnerability than CVE-2009-2632."
    },
    {
      "lang": "es",
      "value": "M\u00faltiples desbordamientos de b\u00fafer basados en pila en el complemento -plugin- Sieve de Dovecot v1.0 anterior a v1.0.4 y v1.1 anterior a v1.1.7, como se deriva de Cyrus libsieve, permiten a atacantes dependientes del contexto provocar una denegaci\u00f3n de servicio (ca\u00edda) y puede que ejecutar c\u00f3digo de su elecci\u00f3n a trav\u00e9s de una secuencia de comandos SIEVE, como se ha demostrado reenviando un mensaje de correo a un gran n\u00famero de usuarios. Se trata de una vulnerabilidad diferente de CVE-2009-2632."
    }
  ],
  "id": "CVE-2009-3235",
  "lastModified": "2026-06-16T23:11:11.957",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "HIGH",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 7.5,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 10.0,
        "impactScore": 6.4,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ]
  },
  "published": "2009-09-17T10:30:01.327",
  "references": [
    {
      "source": "cve@mitre.org",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "http://dovecot.org/list/dovecot-news/2009-September/000135.html"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://lists.apple.com/archives/security-announce/2009/Nov/msg00000.html"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00001.html"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://lists.opensuse.org/opensuse-security-announce/2009-11/msg00004.html"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/36698"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/36713"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://secunia.com/advisories/36904"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://support.apple.com/kb/HT3937"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.openwall.com/lists/oss-security/2009/09/14/3"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.osvdb.org/58103"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securityfocus.com/bid/36377"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.ubuntu.com/usn/USN-838-1"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://www.vupen.com/english/advisories/2009/2641"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.vupen.com/english/advisories/2009/3184"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/53248"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10515"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Patch"
      ],
      "url": "https://www.redhat.com/archives/fedora-package-announce/2009-September/msg00491.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "http://dovecot.org/list/dovecot-news/2009-September/000135.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://lists.apple.com/archives/security-announce/2009/Nov/msg00000.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00001.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://lists.opensuse.org/opensuse-security-announce/2009-11/msg00004.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/36698"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/36713"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/36904"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://support.apple.com/kb/HT3937"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.openwall.com/lists/oss-security/2009/09/14/3"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.osvdb.org/58103"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/bid/36377"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.ubuntu.com/usn/USN-838-1"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://www.vupen.com/english/advisories/2009/2641"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.vupen.com/english/advisories/2009/3184"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/53248"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10515"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "https://www.redhat.com/archives/fedora-package-announce/2009-September/msg00491.html"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-119"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

GHSA-VM7H-XXVX-G2FW

Vulnerability from github – Published: 2022-05-02 03:43 – Updated: 2022-05-02 03:43

Details

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2009-3235"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-119"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2009-09-17T10:30:00Z",
    "severity": "HIGH"
  },
  "details": "Multiple stack-based buffer overflows in the Sieve plugin in Dovecot 1.0 before 1.0.4 and 1.1 before 1.1.7, as derived from Cyrus libsieve, allow context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted SIEVE script, as demonstrated by forwarding an e-mail message to a large number of recipients, a different vulnerability than CVE-2009-2632.",
  "id": "GHSA-vm7h-xxvx-g2fw",
  "modified": "2022-05-02T03:43:03Z",
  "published": "2022-05-02T03:43:03Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2009-3235"
    },
    {
      "type": "WEB",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/53248"
    },
    {
      "type": "WEB",
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10515"
    },
    {
      "type": "WEB",
      "url": "https://www.redhat.com/archives/fedora-package-announce/2009-September/msg00491.html"
    },
    {
      "type": "WEB",
      "url": "http://dovecot.org/list/dovecot-news/2009-September/000135.html"
    },
    {
      "type": "WEB",
      "url": "http://lists.apple.com/archives/security-announce/2009/Nov/msg00000.html"
    },
    {
      "type": "WEB",
      "url": "http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00001.html"
    },
    {
      "type": "WEB",
      "url": "http://lists.opensuse.org/opensuse-security-announce/2009-11/msg00004.html"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/36698"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/36713"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/36904"
    },
    {
      "type": "WEB",
      "url": "http://support.apple.com/kb/HT3937"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2009/09/14/3"
    },
    {
      "type": "WEB",
      "url": "http://www.osvdb.org/58103"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/36377"
    },
    {
      "type": "WEB",
      "url": "http://www.ubuntu.com/usn/USN-838-1"
    },
    {
      "type": "WEB",
      "url": "http://www.vupen.com/english/advisories/2009/2641"
    },
    {
      "type": "WEB",
      "url": "http://www.vupen.com/english/advisories/2009/3184"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

GSD-2009-3235

Vulnerability from gsd - Updated: 2023-12-13 01:19

Details

Aliases

CVE-2009-3235

Aliases

CVE-2009-3235

JSON

To clipboard

{
  "GSD": {
    "alias": "CVE-2009-3235",
    "description": "Multiple stack-based buffer overflows in the Sieve plugin in Dovecot 1.0 before 1.0.4 and 1.1 before 1.1.7, as derived from Cyrus libsieve, allow context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted SIEVE script, as demonstrated by forwarding an e-mail message to a large number of recipients, a different vulnerability than CVE-2009-2632.",
    "id": "GSD-2009-3235",
    "references": [
      "https://www.suse.com/security/cve/CVE-2009-3235.html",
      "https://www.debian.org/security/2009/dsa-1893",
      "https://www.debian.org/security/2009/dsa-1892",
      "https://access.redhat.com/errata/RHSA-2009:1459",
      "https://linux.oracle.com/cve/CVE-2009-3235.html"
    ]
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2009-3235"
      ],
      "details": "Multiple stack-based buffer overflows in the Sieve plugin in Dovecot 1.0 before 1.0.4 and 1.1 before 1.1.7, as derived from Cyrus libsieve, allow context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted SIEVE script, as demonstrated by forwarding an e-mail message to a large number of recipients, a different vulnerability than CVE-2009-2632.",
      "id": "GSD-2009-3235",
      "modified": "2023-12-13T01:19:49.627504Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "cve@mitre.org",
        "ID": "CVE-2009-3235",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "n/a",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "n/a"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "n/a"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "Multiple stack-based buffer overflows in the Sieve plugin in Dovecot 1.0 before 1.0.4 and 1.1 before 1.1.7, as derived from Cyrus libsieve, allow context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted SIEVE script, as demonstrated by forwarding an e-mail message to a large number of recipients, a different vulnerability than CVE-2009-2632."
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "n/a"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "36377",
            "refsource": "BID",
            "url": "http://www.securityfocus.com/bid/36377"
          },
          {
            "name": "cmu-sieve-dovecot-unspecified-bo(53248)",
            "refsource": "XF",
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/53248"
          },
          {
            "name": "36713",
            "refsource": "SECUNIA",
            "url": "http://secunia.com/advisories/36713"
          },
          {
            "name": "SUSE-SR:2009:018",
            "refsource": "SUSE",
            "url": "http://lists.opensuse.org/opensuse-security-announce/2009-11/msg00004.html"
          },
          {
            "name": "[Dovecot-news] 20090914 Security holes in CMU Sieve plugin",
            "refsource": "MLIST",
            "url": "http://dovecot.org/list/dovecot-news/2009-September/000135.html"
          },
          {
            "name": "USN-838-1",
            "refsource": "UBUNTU",
            "url": "http://www.ubuntu.com/usn/USN-838-1"
          },
          {
            "name": "58103",
            "refsource": "OSVDB",
            "url": "http://www.osvdb.org/58103"
          },
          {
            "name": "oval:org.mitre.oval:def:10515",
            "refsource": "OVAL",
            "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10515"
          },
          {
            "name": "ADV-2009-3184",
            "refsource": "VUPEN",
            "url": "http://www.vupen.com/english/advisories/2009/3184"
          },
          {
            "name": "SUSE-SR:2009:016",
            "refsource": "SUSE",
            "url": "http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00001.html"
          },
          {
            "name": "36904",
            "refsource": "SECUNIA",
            "url": "http://secunia.com/advisories/36904"
          },
          {
            "name": "36698",
            "refsource": "SECUNIA",
            "url": "http://secunia.com/advisories/36698"
          },
          {
            "name": "ADV-2009-2641",
            "refsource": "VUPEN",
            "url": "http://www.vupen.com/english/advisories/2009/2641"
          },
          {
            "name": "APPLE-SA-2009-11-09-1",
            "refsource": "APPLE",
            "url": "http://lists.apple.com/archives/security-announce/2009/Nov/msg00000.html"
          },
          {
            "name": "FEDORA-2009-9559",
            "refsource": "FEDORA",
            "url": "https://www.redhat.com/archives/fedora-package-announce/2009-September/msg00491.html"
          },
          {
            "name": "[oss-security] 20090914 Re: CVE for recent cyrus-imap issue",
            "refsource": "MLIST",
            "url": "http://www.openwall.com/lists/oss-security/2009/09/14/3"
          },
          {
            "name": "http://support.apple.com/kb/HT3937",
            "refsource": "CONFIRM",
            "url": "http://support.apple.com/kb/HT3937"
          }
        ]
      }
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:dovecot:dovecot:1.0.2:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:dovecot:dovecot:1.0.3:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:dovecot:dovecot:1.1.5:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:dovecot:dovecot:1.1.6:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:dovecot:dovecot:1.0.1:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:dovecot:dovecot:1.1.1:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:dovecot:dovecot:1.1.2:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:dovecot:dovecot:1.1:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:dovecot:dovecot:1.1.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:dovecot:dovecot:1.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:dovecot:dovecot:1.1.3:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:dovecot:dovecot:1.1.4:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2009-3235"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "Multiple stack-based buffer overflows in the Sieve plugin in Dovecot 1.0 before 1.0.4 and 1.1 before 1.1.7, as derived from Cyrus libsieve, allow context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted SIEVE script, as demonstrated by forwarding an e-mail message to a large number of recipients, a different vulnerability than CVE-2009-2632."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "CWE-119"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "58103",
              "refsource": "OSVDB",
              "tags": [],
              "url": "http://www.osvdb.org/58103"
            },
            {
              "name": "FEDORA-2009-9559",
              "refsource": "FEDORA",
              "tags": [
                "Patch"
              ],
              "url": "https://www.redhat.com/archives/fedora-package-announce/2009-September/msg00491.html"
            },
            {
              "name": "ADV-2009-2641",
              "refsource": "VUPEN",
              "tags": [
                "Vendor Advisory"
              ],
              "url": "http://www.vupen.com/english/advisories/2009/2641"
            },
            {
              "name": "[oss-security] 20090914 Re: CVE for recent cyrus-imap issue",
              "refsource": "MLIST",
              "tags": [],
              "url": "http://www.openwall.com/lists/oss-security/2009/09/14/3"
            },
            {
              "name": "[Dovecot-news] 20090914 Security holes in CMU Sieve plugin",
              "refsource": "MLIST",
              "tags": [
                "Patch",
                "Vendor Advisory"
              ],
              "url": "http://dovecot.org/list/dovecot-news/2009-September/000135.html"
            },
            {
              "name": "36698",
              "refsource": "SECUNIA",
              "tags": [
                "Vendor Advisory"
              ],
              "url": "http://secunia.com/advisories/36698"
            },
            {
              "name": "36377",
              "refsource": "BID",
              "tags": [],
              "url": "http://www.securityfocus.com/bid/36377"
            },
            {
              "name": "36713",
              "refsource": "SECUNIA",
              "tags": [
                "Vendor Advisory"
              ],
              "url": "http://secunia.com/advisories/36713"
            },
            {
              "name": "36904",
              "refsource": "SECUNIA",
              "tags": [],
              "url": "http://secunia.com/advisories/36904"
            },
            {
              "name": "USN-838-1",
              "refsource": "UBUNTU",
              "tags": [],
              "url": "http://www.ubuntu.com/usn/USN-838-1"
            },
            {
              "name": "SUSE-SR:2009:016",
              "refsource": "SUSE",
              "tags": [],
              "url": "http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00001.html"
            },
            {
              "name": "http://support.apple.com/kb/HT3937",
              "refsource": "CONFIRM",
              "tags": [],
              "url": "http://support.apple.com/kb/HT3937"
            },
            {
              "name": "APPLE-SA-2009-11-09-1",
              "refsource": "APPLE",
              "tags": [],
              "url": "http://lists.apple.com/archives/security-announce/2009/Nov/msg00000.html"
            },
            {
              "name": "ADV-2009-3184",
              "refsource": "VUPEN",
              "tags": [],
              "url": "http://www.vupen.com/english/advisories/2009/3184"
            },
            {
              "name": "SUSE-SR:2009:018",
              "refsource": "SUSE",
              "tags": [],
              "url": "http://lists.opensuse.org/opensuse-security-announce/2009-11/msg00004.html"
            },
            {
              "name": "cmu-sieve-dovecot-unspecified-bo(53248)",
              "refsource": "XF",
              "tags": [],
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/53248"
            },
            {
              "name": "oval:org.mitre.oval:def:10515",
              "refsource": "OVAL",
              "tags": [],
              "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10515"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV2": {
          "cvssV2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 7.5,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          "exploitabilityScore": 10.0,
          "impactScore": 6.4,
          "obtainAllPrivilege": false,
          "obtainOtherPrivilege": false,
          "obtainUserPrivilege": false,
          "severity": "HIGH",
          "userInteractionRequired": false
        }
      },
      "lastModifiedDate": "2017-09-19T01:29Z",
      "publishedDate": "2009-09-17T10:30Z"
    }
  }
}

OPENSUSE-SU-2024:10015-1

Vulnerability from csaf_opensuse - Published: 2024-06-15 00:00 - Updated: 2026-09-20 19:50

Summary

cyradm-2.4.18-3.4 on GA media

Severity

Moderate

Scope

4 vulnerabilities in this advisory, including CVE-2009-3235.

CVE-2009-3235

Recommended: 32 products

Open the full advisory

RHSA-2009:1459

Vulnerability from csaf_redhat - Published: 2009-09-23 14:50 - Updated: 2026-06-25 10:36

Summary

Red Hat Security Advisory: cyrus-imapd security update

Severity

Important

Scope

2 vulnerabilities in this advisory, including CVE-2009-3235.

CVE-2009-3235

6.5 ()


                
                  AV:N/AC:L/Au:S/C:P/I:P/A:P

Fixed: 143 products

https://access.redhat.com/errata/RHSA-2009:1459

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2009-3235 (GCVE-0-2009-3235)

CERTA-2009-AVI-487

Description

Solution

FKIE_CVE-2009-3235

GHSA-VM7H-XXVX-G2FW

GSD-2009-3235

OPENSUSE-SU-2024:10015-1

RHSA-2009:1459

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour