CVE-2009-0688

Multiple buffer overflows in the CMU Cyrus SASL library before 2.1.23 might allow remote attackers to execute arbitrary code or cause a denial of service (application crash) via strings that are used as input to the sasl_encode64 function in lib/saslutil.c.

🔗 References (78)

• cret@certftp://ftp.andrew.cmu.edu/pub/cyrus-mail/cyrus-sasl-2.1.23.tar.gz
• cret@certhttp://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html
• cret@certhttp://lists.opensuse.org/opensuse-security-announce/2009-06/msg00003.html
• cret@certhttp://osvdb.org/54514
• cret@certhttp://osvdb.org/54515
• cret@certhttp://secunia.com/advisories/35094
• cret@certhttp://secunia.com/advisories/35097
• cret@certhttp://secunia.com/advisories/35102
• cret@certhttp://secunia.com/advisories/35206
• cret@certhttp://secunia.com/advisories/35239
• cret@certhttp://secunia.com/advisories/35321
• cret@certhttp://secunia.com/advisories/35416
• cret@certhttp://secunia.com/advisories/35497
• cret@certhttp://secunia.com/advisories/35746
• cret@certhttp://secunia.com/advisories/39428