Homepage

Out-of-Bounds The advisory has been revoked - it doesn't affect any version of package alpine  (opens in a new tab)

Threat Intelligence

EPSS
11.78% (96th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-DEBIAN9-ALPINE-598979
  • published10 Nov 2008
  • disclosed10 Nov 2008
Report a new vulnerability Found a mistake?

Introduced: 10 Nov 2008

CVE-2008-5005  (opens in a new tab)
CWE-119  (opens in a new tab)

Amendment

The Debian security team deemed this advisory irrelevant for Debian:9.

NVD Description

Note: Versions mentioned in the description apply only to the upstream alpine package and not the alpine package as distributed by Debian.

Multiple stack-based buffer overflows in (1) University of Washington IMAP Toolkit 2002 through 2007c, (2) University of Washington Alpine 2.00 and earlier, and (3) Panda IMAP allow (a) local users to gain privileges by specifying a long folder extension argument on the command line to the tmail or dmail program; and (b) remote attackers to execute arbitrary code by sending e-mail to a destination mailbox name composed of a username and '+' character followed by a long string, processed by the tmail or possibly dmail program.

References