Show filters
4 Total Results
Displaying 1-4 of 4
Sort by:
Attacker Value
Unknown

CVE-2009-0688

Disclosure Date: May 15, 2009 (last updated October 04, 2023)
Multiple buffer overflows in the CMU Cyrus SASL library before 2.1.23 might allow remote attackers to execute arbitrary code or cause a denial of service (application crash) via strings that are used as input to the sasl_encode64 function in lib/saslutil.c.
0
0
Attacker Value
Unknown

CVE-2004-0884

Disclosure Date: January 27, 2005 (last updated February 22, 2025)
The (1) libsasl and (2) libsasl2 libraries in Cyrus-SASL 2.1.18 and earlier trust the SASL_PATH environment variable to find all available SASL plug-ins, which allows local users to execute arbitrary code by modifying the SASL_PATH to point to malicious programs.
0
0
Attacker Value
Unknown

CVE-2005-0373

Disclosure Date: October 07, 2004 (last updated February 22, 2025)
Buffer overflow in digestmd5.c CVS release 1.170 (also referred to as digestmda5.c), as used in the DIGEST-MD5 SASL plugin for Cyrus-SASL but not in any official releases, allows remote attackers to execute arbitrary code.
0
0
Attacker Value
Unknown

CVE-2002-2043

Disclosure Date: December 31, 2002 (last updated February 22, 2025)
SQL injection vulnerability in the LDAP and MySQL authentication patch for Cyrus SASL 1.5.24 and 1.5.27 allows remote attackers to execute arbitrary SQL commands and log in as arbitrary POP mail users via the password.
0
0