CVE-2015-8078

Name of the Vulnerable Software and Affected Versions Cyrus IMAP versions 2.3.19 through 2.5.6

Description The issue is caused by an integer overflow in the index urlfetch function in imap/index.c, which can be exploited by remote attackers to have an unspecified impact. This is related to urlfetch range checks and the section offset variable. The vulnerability exists due to an incomplete fix for a previous issue.

Recommendations For versions 2.3.19, 2.4.18, and 2.5.6, consider disabling the index urlfetch function as a temporary workaround until a patch is available. Restrict access to the imap/index.c module to minimize the risk of exploitation. Avoid using the section offset variable in the affected urlfetch range checks until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.