CVEvulnerability

CVE-2008-5005

10.0 HIGH Published 2008-11-10 Modified 2026-06-16 Official page ↗
Status
Modified
Published
2008-11-10
Last modified
2026-06-16
Assigner
[email protected]
CVSS 2.0 ([email protected])
10.0 HIGH — AV:N/AC:L/Au:N/C:C/I:C/A:C
Weaknesses
CWE-119

Description

Multiple stack-based buffer overflows in (1) University of Washington IMAP Toolkit 2002 through 2007c, (2) University of Washington Alpine 2.00 and earlier, and (3) Panda IMAP allow (a) local users to gain privileges by specifying a long folder extension argument on the command line to the tmail or dmail program; and (b) remote attackers to execute arbitrary code by sending e-mail to a destination mailbox name composed of a username and '+' character followed by a long string, processed by the tmail or possibly dmail program.

Affected configurations

• university of washington alpine 0.80 • university of washington alpine 0.81 • university of washington alpine 0.82 • university of washington alpine 0.83 • university of washington alpine 0.98 • university of washington alpine 0.99 • university of washington alpine 0.999 • university of washington alpine 0.9999 • university of washington alpine 0.99999 • university of washington alpine 0.999999 • university of washington alpine 1.00 • university of washington alpine 1.10 • university of washington alpine 2.00 • university of washington imap toolkit 2002 • university of washington imap toolkit 2003 • university of washington imap toolkit 2004 • university of washington imap toolkit 2005 • university of washington imap toolkit 2006 • university of washington imap toolkit 2007 • university of washington imap toolkit 2007c

Related

Weakness · CWE (1)

  • CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer weakness

Referenced by CWE · observed example (1)

  • CWE-676 Use of Potentially Dangerous Function weakness

References