01 Record

CVE-2015-8078

Integer overflow in the index_urlfetch function in imap/index.c in Cyrus IMAP 2.3.19, 2.4.18, and 2.5.6 allows remote attackers to have unspecified impact via vectors related to urlfetch range checks

UnratedPUBLISHEDCNA: redhat

CNA base scoreUnratedNo CNA CVSS vector

View raw JSON

02 Description

Integer overflow in the index_urlfetch function in imap/index.c in Cyrus IMAP 2.3.19, 2.4.18, and 2.5.6 allows remote attackers to have unspecified impact via vectors related to urlfetch range checks

03 Exploitation and scoring

Exploitation: Not assessed. CISA has not published an exploitation assessment for this record, and it is not in the KEV catalog. That is an absence of assessment, not a finding of no risk.
SSVC decision: Not assessed by CISA
EPSS probability: 2.75% probability of exploitation activity in the next 30 days.
EPSS percentile: Equal to or higher than the score of 85.9% of scored records. A rank, not a probability.
NVD base score: The NVD has published no score for this record
NVD CVSS vector: No NVD score to derive
NVD analysis status: Modified. NVD last modified this record on 2026-06-17.
Red Hat severity: Moderate. Red Hat's rating for its own products, not a CVSS rating.

Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.

04 Metadata

Published

2015-12-03 20:00Z10 YR AGO

Last updated

2024-08-06 08:06Z2 YR AGO

Reserved

2015-11-04

Assigning CNA

redhat

Record state

PUBLISHED

Severity

Not rated by the issuing CNA

CNA CVSS vector

Not published by the issuing CNA

Weaknesses

CWE-189
CWE-190Integer Overflow or WraparoundBase

Data version

5.1

Document digest

0f9fe9df0f542fb969b36892985607692f859522bfa293d34f810238da9ca2cc

05 Affected products

VendorProductVersionsPlatforms

cyrusimapNot specified—

opensuseleapNot specified—

opensuseopensuseNot specified—

redhatenterprise_linuxNot specified—

06 References

docs.cyrus.foundationhttps://docs.cyrus.foundation/imap/release-notes/2.5/x/2.5.7.htmlx_refsource_CONFIRM
www.openwall.com[oss-security] 20151104 Re: CVE request: urlfetch range handling flaw in Cyrus IMAPhttp://www.openwall.com/lists/oss-security/2015/11/04/3mailing-listx_refsource_MLIST
lists.opensuse.orgopenSUSE-SU-2015:2130http://lists.opensuse.org/opensuse-updates/2015-11/msg00156.htmlvendor-advisoryx_refsource_SUSE
lists.opensuse.orgSUSE-SU-2016:1459http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00000.htmlvendor-advisoryx_refsource_SUSE
www.securitytracker.com1034282http://www.securitytracker.com/id/1034282vdb-entryx_refsource_SECTRACK
lists.opensuse.orgSUSE-SU-2016:1457http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00066.htmlvendor-advisoryx_refsource_SUSE
cyrus.foundationhttps://cyrus.foundation/cyrus-imapd/commit/?id=6fb6a272171f49c79ba6ab7c6403eb25b39ec1b2x_refsource_CONFIRM

07 Fixed in

Ubuntu 16.04 LTS

cyrus-imapd-2.4
No fix yet

Source: Ubuntu, Canonical Ltd. Licensed under CC BY-SA 4.0. Received through OSV.dev. Reformatted by exploit.cc.

A release or ecosystem missing from this list has no record here. It may be unaffected or not covered by the source. Source notices and licences.