NULL pointer dereference in Red Hat Inc. products - CVE-2011-3481
Published: August 28, 2016
Vulnerability identifier: #VU352
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2011-3481
CWE-ID: CWE-476
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vendor: Red Hat Inc.
Affected software:
RHEL Desktop Workstation
Red Hat Desktop
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux AS
Red Hat Enterprise Linux ES
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux Server EUS
Red Hat Enterprise Linux WS
Red Hat Enterprise Linux Workstation
Red Hat cyrus-imapd
RHEL Desktop Workstation
Red Hat Desktop
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux AS
Red Hat Enterprise Linux ES
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux Server EUS
Red Hat Enterprise Linux WS
Red Hat Enterprise Linux Workstation
Red Hat cyrus-imapd
Detailed vulnerability description
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to a NULL pointer dereference error when handling email messages in imapd service. A remote attacker can send a specially crafted email message to victim and prevent the victim from accessing further emails, if the victim uses IMAP client, which relies on the server threading IMAP feature.
Successful exploitation of this vulnerability will prevent the victim from accessing email messages.