Bugzilla – Bug 954200
VUL-0: CVE-2015-8077: cyrus-imapd: Integer overflow in range checks
Last modified: 2016-08-01 09:04:03 UTC
Quoting from RH BZ: "An integer overflow vulnerability that emerged after applying partial fix for CVE-2015-8076 by commit https://cyrus.foundation/cyrus-imapd/commit/?id=07de4ff1bf2fa340b9d77b8e7de8d43d47a33921 was found." patch: https://cyrus.foundation/cyrus-imapd/commit/?id=745e161c834f1eb6d62fc14477f51dae799e1e08 References: https://bugzilla.redhat.com/show_bug.cgi?id=1278374 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-8077 http://people.canonical.com/~ubuntu-security/cve/2015/CVE-2015-8077.html http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8077
bugbot adjusting priority
Created SR#344607 for openSUSE_13.2 and openSUSE_Leap_42.1 (both containing patches for cyrus-imapd 2.4). Created SR#344608 for openSUSE_Tumleweed (containing cyrus-imapd 2.4) Does this issue also affect cyrus-imapd 2.3?
This is an autogenerated message for OBS integration: This bug (954200) was mentioned in https://build.opensuse.org/request/show/344607 13.2+Leap:42.1 / cyrus-imapd.openSUSE_Leap_42.1_Update+cyrus-imapd_13.2
Aeneas, so openSUSE was indeed affected because of the initial broken fix for CVE-2015-8076 that was applied?
(In reply to Sebastian Krahmer from comment #5) > Aeneas, so openSUSE was indeed affected because of the initial > broken fix for CVE-2015-8076 that was applied? Yes, although I didn't test this myself. The broken fix was: https://cyrus.foundation/cyrus-imapd/commit/?id=07de4ff1bf2fa340b9d77b8e7de8d43d47a33921 urlfetch: handle range starting outside message size and was backported to 2.4 (released in 2.4.18) and 2.3 (released in 2.3.19), see https://cyrus.foundation/cyrus-imapd/commit/?h=cyrus-imapd-2.3&id=5222440300a2fe73a6715cf402764e40ea028153 https://cyrus.foundation/cyrus-imapd/commit/?h=cyrus-imapd-2.4&id=56cfe0ac23445697fba2fb19474e443d9efa2d9e In 2.3.19, we have /* Sanity check the requested size */ if (size && (offset + size > msg_size)) n = msg_size - offset; else n = size whereas unsigned long msg_size = 0; ... unsigned size, offset = 0, skip = 0; int n, r = 0; ,so it looks vulnerable to me. In the distributions, we have: https://build.opensuse.org/package/show/openSUSE:13.1:Update/cyrus-imapd => 2.3.19 https://build.opensuse.org/package/show/openSUSE:13.2:Update/cyrus-imapd => 2.4.18 https://build.opensuse.org/package/show/openSUSE:Leap:42.1/cyrus-imapd => 2.4.18
https://build.opensuse.org/request/show/345351 Patched 2.3.19 for openSUSE 13.1
(In reply to Aeneas Jaißle from comment #3) 2.3 misses these checks completely, so yes
openSUSE-SU-2015:2130-1: An update that fixes two vulnerabilities is now available. Category: security (moderate) Bug References: 954200,954201 CVE References: CVE-2015-8077,CVE-2015-8078 Sources used: openSUSE Leap 42.1 (src): cyrus-imapd-2.4.18-3.1 openSUSE 13.2 (src): cyrus-imapd-2.4.18-2.10.1
also fix for sle10-sle12
openSUSE-SU-2015:2200-1: An update that fixes one vulnerability is now available. Category: security (moderate) Bug References: 954200 CVE References: CVE-2015-8077 Sources used: openSUSE 13.1 (src): cyrus-imapd-2.3.19-34.6.1
CVE-2015-8076 was missed, now (bsc#981670) It will be simpler to create 1 patch fixing both issues here as the patches don't apply cleanly
An update workflow for this issue was started. This issue was rated as important. Please submit fixed packages until 2016-06-06. When done, reassign the bug to security-team@suse.de. https://swamp.suse.de/webswamp/wf/62790
SUSE-SU-2016:1457-1: An update that solves four vulnerabilities and has one errata is now available. Category: security (important) Bug References: 860611,901748,954200,954201,981670 CVE References: CVE-2014-3566,CVE-2015-8076,CVE-2015-8077,CVE-2015-8078 Sources used: SUSE Linux Enterprise Server 12-SP1 (src): cyrus-imapd-2.3.18-37.1 SUSE Linux Enterprise Server 12 (src): cyrus-imapd-2.3.18-37.1
SUSE-SU-2016:1459-1: An update that solves four vulnerabilities and has one errata is now available. Category: security (important) Bug References: 860611,901748,954200,954201,981670 CVE References: CVE-2014-3566,CVE-2015-8076,CVE-2015-8077,CVE-2015-8078 Sources used: SUSE Linux Enterprise Software Development Kit 11-SP4 (src): cyrus-imapd-2.3.11-60.65.67.1 SUSE Linux Enterprise Server 11-SP4 (src): cyrus-imapd-2.3.11-60.65.67.1 SUSE Linux Enterprise Debuginfo 11-SP4 (src): cyrus-imapd-2.3.11-60.65.67.1
released