Unscored severity · published Dec 3, 2015
CVE-2015-8076
The index_urlfetch function in index.c in Cyrus IMAP 2.3.x before 2.3.19, 2.4.x before 2.4.18, 2.5.x before 2.5.4 allows remote attackers to obtain sensitive information or…
–
CVSS
3.3%
EPSS
No
On KEV
Description
The index_urlfetch function in index.c in Cyrus IMAP 2.3.x before 2.3.19, 2.4.x before 2.4.18, 2.5.x before 2.5.4 allows remote attackers to obtain sensitive information or possibly have unspecified other impact via vectors related to the urlfetch range, which triggers an out-of-bounds heap read.
Exploitation
Is it being used?
Exploit prediction (EPSS)3.3% · higher than 88% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IM
Imap · Cyrus
2.3.0; 2.3.1; 2.3.2; 2.3.3; 2.3.4; 2.3.5; +34 more · source: NVD
LE
Leap · Opensuse
42.1 · source: NVD
OP
Opensuse · Opensuse
13.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2015-8076
CVE.org
https://www.cve.org/CVERecord?id=CVE-2015-8076
lists.opensuse.org
http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00066.html
lists.opensuse.org
http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00000.html
lists.opensuse.org
http://lists.opensuse.org/opensuse-updates/2015-09/msg00037.html
lists.opensuse.org
http://lists.opensuse.org/opensuse-updates/2015-09/msg00038.html
www.openwall.com
http://www.openwall.com/lists/oss-security/2015/09/29/2
www.openwall.com
http://www.openwall.com/lists/oss-security/2015/09/30/3
More from Imap
9.8
CVE-2019-18928
Cyrus IMAP 2.5.x before 2.5.14 and 3.x before 3.0.12 allows privilege escalation because an HTTP request may be interpreted in the authentication context of an unrelated previous…
9.8
CVE-2019-11356
The CalDAV feature in httpd in Cyrus IMAP 2.5.x through 2.5.12 and 3.0.x through 3.0.9 allows remote attackers to execute arbitrary code via a crafted HTTP PUT operation for an…
9.1
CVE-2017-14230
In the mboxlist_do_find function in imap/mboxlist.c in Cyrus IMAP before 3.0.4, an off-by-one error in prefix calculation for the LIST command caused use of uninitialized memory,…
7.5
CVE-2021-33582
Cyrus IMAP before 3.4.2 allows remote attackers to cause a denial of service (multiple-minute daemon hang) via input that is mishandled during hash-table interaction
7.1
CVE-2026-61915
An issue was discovered in Cyrus IMAP before 3.12.4