Name of the Vulnerable Software and Affected Versions:
mbsync versions prior to 1.3.6
mbsync versions prior to 1.4.2
Description:
A flaw was found in mbsync where an unchecked pointer cast allows a malicious or compromised server to write an arbitrary integer value past the end of a heap-allocated structure by issuing an unexpected APPENDUID response. This could be plausibly exploited for remote code execution on the client.
Recommendations:
For versions prior to 1.3.6, update to version 1.3.6 or later.
For versions prior to 1.4.2, update to version 1.4.2 or later.