NULL pointer dereference in Red Hat Inc. products - CVE-2011-3481

Vulnerability identifier: #VU352

CSH Severity: Low

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2011-3481

CWE-ID: CWE-476

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference error when handling email messages in imapd service. A remote attacker can send a specially crafted email message to victim and prevent the victim from accessing further emails, if the victim uses IMAP client, which relies on the server threading IMAP feature.

Successful exploitation of this vulnerability will prevent the victim from accessing email messages.

Red Hat cyrus-imapd
Red Hat Desktop
Red Hat Enterprise Linux AS
Red Hat Enterprise Linux ES
Red Hat Enterprise Linux WS
Red Hat Enterprise Linux for x86_64
RHEL Desktop Workstation
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Server EUS
Debian Linux
Amazon Linux AMI
Red Hat Enterprise Linux for IBM z Systems

• https://rhn.redhat.com/errata/RHSA-2011-1508.html

• Multiple vulnerabilities in Red Hat cyrus-imapd
• Debian update for cyrus-imapd-2.2
• Amazon Linux AMI update for cyrus-imapd
• Red Hat update for cyrus-imapd