Описание
ELSA-2011-0859: cyrus-imapd security update (MODERATE)
[2.3.16-6.2]
- do not use strict aliasing
[2.3.16-6.1]
- fix CVE-2011-1926: STARTTLS plaintext command injection vulnerability
Обновленные пакеты
Oracle Linux 6
Oracle Linux x86_64
cyrus-imapd
2.3.16-6.el6_1.2
cyrus-imapd-devel
2.3.16-6.el6_1.2
cyrus-imapd-utils
2.3.16-6.el6_1.2
Oracle Linux i686
cyrus-imapd
2.3.16-6.el6_1.2
cyrus-imapd-devel
2.3.16-6.el6_1.2
cyrus-imapd-utils
2.3.16-6.el6_1.2
Oracle Linux 5
Oracle Linux ia64
cyrus-imapd
2.3.7-7.0.1.el5_6.4
cyrus-imapd-devel
2.3.7-7.0.1.el5_6.4
cyrus-imapd-perl
2.3.7-7.0.1.el5_6.4
cyrus-imapd-utils
2.3.7-7.0.1.el5_6.4
Oracle Linux x86_64
cyrus-imapd
2.3.7-7.0.1.el5_6.4
cyrus-imapd-devel
2.3.7-7.0.1.el5_6.4
cyrus-imapd-perl
2.3.7-7.0.1.el5_6.4
cyrus-imapd-utils
2.3.7-7.0.1.el5_6.4
Oracle Linux i386
cyrus-imapd
2.3.7-7.0.1.el5_6.4
cyrus-imapd-devel
2.3.7-7.0.1.el5_6.4
cyrus-imapd-perl
2.3.7-7.0.1.el5_6.4
cyrus-imapd-utils
2.3.7-7.0.1.el5_6.4
Связанные CVE
Связанные уязвимости
The STARTTLS implementation in Cyrus IMAP Server before 2.4.7 does not properly restrict I/O buffering, which allows man-in-the-middle attackers to insert commands into encrypted sessions by sending a cleartext command that is processed after TLS is in place, related to a "plaintext command injection" attack, a similar issue to CVE-2011-0411.
The STARTTLS implementation in Cyrus IMAP Server before 2.4.7 does not properly restrict I/O buffering, which allows man-in-the-middle attackers to insert commands into encrypted sessions by sending a cleartext command that is processed after TLS is in place, related to a "plaintext command injection" attack, a similar issue to CVE-2011-0411.
The STARTTLS implementation in Cyrus IMAP Server before 2.4.7 does not properly restrict I/O buffering, which allows man-in-the-middle attackers to insert commands into encrypted sessions by sending a cleartext command that is processed after TLS is in place, related to a "plaintext command injection" attack, a similar issue to CVE-2011-0411.
The STARTTLS implementation in Cyrus IMAP Server before 2.4.7 does not ...
The STARTTLS implementation in Cyrus IMAP Server before 2.4.7 does not properly restrict I/O buffering, which allows man-in-the-middle attackers to insert commands into encrypted sessions by sending a cleartext command that is processed after TLS is in place, related to a "plaintext command injection" attack, a similar issue to CVE-2011-0411.