#VU352 NULL pointer dereference in Red Hat Inc. products - CVE-2011-3481
Published: August 28, 2016
Vulnerability identifier: #VU352
Vulnerability risk: Low
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2011-3481
CWE-ID: CWE-476
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerable software:
RHEL Desktop Workstation
Red Hat Desktop
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux AS
Red Hat Enterprise Linux ES
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux Server EUS
Red Hat Enterprise Linux WS
Red Hat Enterprise Linux Workstation
Red Hat cyrus-imapd
RHEL Desktop Workstation
Red Hat Desktop
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux AS
Red Hat Enterprise Linux ES
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux Server EUS
Red Hat Enterprise Linux WS
Red Hat Enterprise Linux Workstation
Red Hat cyrus-imapd
Software vendor:
Red Hat Inc.
Red Hat Inc.
Description
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to a NULL pointer dereference error when handling email messages in imapd service. A remote attacker can send a specially crafted email message to victim and prevent the victim from accessing further emails, if the victim uses IMAP client, which relies on the server threading IMAP feature.
Successful exploitation of this vulnerability will prevent the victim from accessing email messages.