An issue was discovered in Cyrus IMAP before 3.12.4. A JMAP email-header blob ID can reference an out-of-bounds index. An authenticated user could attempt to download a crafted JMAP blob ID of the form H<emailid>-<index>, which could read past the end of the internal blobheaders array during download, exposing adjacent heap memory.

An issue was discovered in Cyrus IMAP before 3.12.4. JMAP snooze bypasses the destination-mailbox ACL. An authenticated user with insert permissions on another user's snoozed mailbox could cause insertion of mail to that user's inbox, or any other of their mailboxes whose id was known to the user, despite having no insert permissions to the target mailbox.

A UNIX Symbolic Link (Symlink) Following vulnerability in openSUSE Tumbleweed cyrus-imapd allows escalation from cyrus to root.This issue affects openSUSE Tumbleweed cyrus-imapd before 3.8.4-2.1.

An issue was discovered in Cyrus IMAP before 2.5.15, 3.0.x before 3.0.13, and 3.1.x through 3.1.8. If sieve script uploading is allowed (3.x) or certain non-default sieve options are enabled (2.x), a user with a mail account on the service can use a sieve script containing a fileinto directive to create any mailbox with administrator privileges, because of folder mishandling in autosievecreatefolder() in imap/lmtpsieve.c.

Last updated 25 August 2025

Buffer overflow in the SIEVE script component (sieve/script.c), as used in cyrus-imapd in Cyrus IMAP Server 2.2.13 and 2.3.14, and Dovecot 1.0 before 1.0.4 and 1.1 before 1.1.7, allows local users to execute arbitrary code and read or modify arbitrary messages via a crafted SIEVE script, related to the incorrect use of the sizeof operator for determining buffer length, combined with an integer signedness error.

The indexgetids function in index.c in imapd in Cyrus IMAP Server before 2.4.11, when server-side threading is enabled, allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted References header in an e-mail message.

A remotely exploitable buffer overflow flaw was found in Cyrus' nntpd. A malicious NNTP client would be able to exploit this to execute arbitrary code on a vulnerable nntpd server. If the 'allowanonymouslogin' option was set in imapd.conf, it could be done without authentication.

When compiled with FORTIFYSOURCE (the default on Red Hat Enterprise Linux 5 and 6, as well as Fedora), this flaw is not exploitable and will result in a crash of the nntpd service.

The following patch will correct the flaw:

diff --git a/imap/nntpd.c b/imap/nntpd.c index 56405d3..6b30174 100644 --- a/imap/nntpd.c +++ b/imap/nntpd.c @@ -4131,7 +4131,8 @@ static struct wildmat splitwildmats(char str) else if (c == '@') wild[n].not = -1; / absolute not (feeding) / else wild[n].not = 0;

- strcpy(p, wild[n].not ? c + 1 : c); + strncpy(p, wild[n].not ? c + 1 : c, pattern+sizeof(pattern) - p); + pattern[sizeof(pattern)-1] = '\0'; wild[n++].pat = xstrdup(pattern); } while (c != str); wild[n].pat = NULL;

It was found, that Cyrus IMAP recognized IMAP, LMTP, NNTP and POP3 protocol commands during plaintex to TLS session switch (by TLS protocol initialization). A remote attacker could use this flaw to insert plaintext, protocol relevant, commands into TLS protocol initialization messages, leading to execution of these commands during the ciphertext protocol phase, potentially allowing the attacker to steal the victim's mail or authentication credentials.

References: [1] http://www.kb.cert.org/vuls/id/555316 [2] http://bugzilla.cyrusimap.org/showbug.cgi?id=3423

Relevant upstream patch: [3] http://git.cyrusimap.org/cyrus-imapd/patch/?id=523a91a5e86c8b9a27a138f04a3e3f2d8786f162