SB20261109150 - Anolis OS update for ruby

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20261109150

SB20261109150 - Anolis OS update for ruby

Published: November 9, 2026

Security Bulletin ID SB20261109150
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Command injection (CVE-ID: CVE-2026-47240)

CWE-ID: CWE-77 - Command injection

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows an unprivileged local attacker to inject arbitrary IMAP commands into an application's session and delete mailboxes.

The vulnerability exists due to net-imap accepting non-synchronizing literals in raw arguments without verifying server support. An unprivileged local attacker can supply input that an application passes unvalidated to affected arguments, causing servers lacking literal support that continue after malformed commands to execute embedded commands.


Remediation

Install update from vendor's website.

References