GCVE - cpe:2.3:a:cmu:cyrus_imap_server:2.3.3:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:cmu:cyrus_imap_server:2.3.3:*:*:*:*:*:*:*

part: a version: 2.3.3 update: *

Vendor	Cmu (`d8fc24cc-efa9-507c-a308-194264732bb6`)
Product	Cyrus Imap Server (`8bb12f5d-b21e-5550-9e7c-70de034c08e4`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:deb/debian/cyrus-imapd`	purl2cpe	2026-06-01 10:11:52.337588
`pkg:deb/ubuntu/cyrus-imapd`	purl2cpe	2026-06-01 10:11:52.337590
`pkg:github/cyrusimap/cyrus-imapd`	purl2cpe	2026-06-01 10:11:52.337591
`pkg:gitlab/redhat/cyrus-imapd`	purl2cpe	2026-06-01 10:11:52.337592
`pkg:rpm/centos/cyrus-imapd`	purl2cpe	2026-06-01 10:11:52.337594
`pkg:rpm/fedora/cyrus-imapd`	purl2cpe	2026-06-01 10:11:52.337595
`pkg:rpm/opensuse/cyrus-imapd`	purl2cpe	2026-06-01 10:11:52.337596

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2011-3481`	vulnerable	2026-06-08 04:59:25.682664	Details available The index_get_ids function in index.c in imapd in Cyrus IMAP Server before 2.4.11, when server-side threading is enabled, allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted References header in an e-mail message. Published: 2011-09-14T17:00:00.000Z Updated: 2024-08-06T23:37:47.758Z Open on db.gcve.eu Reference links http://git.cyrusimap.org/cyrus-imapd/commit/?id=6e776956a1a9dfa58eacdd0ddd52644009eac9e5 http://bugzilla.cyrusimap.org/show_bug.cgi?id=3463 http://bugzilla.cyrusimap.org/show_bug.cgi?id=2772 https://exchange.xforce.ibmcloud.com/vulnerabilities/69842 http://www.redhat.com/support/errata/RHSA-2011-1508.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2011-3208`	vulnerable	2026-06-08 04:58:11.154564	Details available Stack-based buffer overflow in the split_wildmats function in nntpd.c in nntpd in Cyrus IMAP Server before 2.3.17 and 2.4.x before 2.4.11 allows remote attackers to execute arbitrary code via a crafted NNTP command. Published: 2011-09-14T17:00:00.000Z Updated: 2024-08-06T23:29:56.064Z Open on db.gcve.eu Reference links https://hermes.opensuse.org/messages/11723935 http://secunia.com/advisories/46064 http://git.cyrusimap.org/cyrus-imapd/commit/?id=3244c18c928fa331f6927e2b8146abe90feafddd http://www.securityfocus.com/bid/49534 http://www.osvdb.org/75307	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2011-1926`	vulnerable	2026-06-08 04:58:02.968811	Details available The STARTTLS implementation in Cyrus IMAP Server before 2.4.7 does not properly restrict I/O buffering, which allows man-in-the-middle attackers to insert commands into encrypted sessions by sending a cleartext command that is processed after TLS is in place, related to a "plaintext command injection" attack, a similar issue to CVE-2011-0411. Published: 2011-05-23T22:00:00.000Z Updated: 2024-08-06T22:46:00.659Z Open on db.gcve.eu Reference links http://www.redhat.com/support/errata/RHSA-2011-0859.html http://lists.fedoraproject.org/pipermail/package-announce/2011-June/061374.html http://www.debian.org/security/2011/dsa-2258 http://www.cyrusimap.org/docs/cyrus-imapd/2.4.7/changes.php http://www.mandriva.com/security/advisories?name=MDVSA-2011:100	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.