CVE-2004-1012: carnegie_mellon_university cyrus_imap_server
Vulnerability summary
CVE-2004-1012 is a high (CVSS 10.0) vulnerability in carnegie_mellon_university cyrus_imap_server. EPSS estimates a 5.95% chance of exploitation in the next 30 days, higher than 93.1% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 1Timeline
- 01-12-2004PublishedVulnerability first disclosed.
- 08-08-2024Last modifiedVulnerability information updated.
Description
The argument parser of the PARTIAL command in Cyrus IMAP Server 2.2.6 and earlier allows remote authenticated users to execute arbitrary code via a certain command ("body[p") that is treated as a different command ("body.peek") and causes an index increment error that leads to an out-of-bounds memory corruption.
CVSS metrics
1 score · 1 source · 1 versionEPSS trend
Probability
5.95%
Chance of exploitation in the next 30 days
Percentile
93%
Versus all other CVEs
30-day change
0.00 pp
From 5.95% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Carnegie_mellon_university1 product
- cyrus_imap_server2.1.7 | 2.1.9 | 2.1.10 | 2.1.16 | 2.2.0_alpha | 2.2.1_beta | 2.2.2_beta | 2.2.3 | 2.2.4 | 2.2.5 | 2.2.6 | 2.2.7 | 2.2.8
Conectiva1 product
- linux9.0 | 10.0
Debian1 product
- cyrus-imapd< 1.5.19-20
Openpkg1 product
- openpkgcurrent
Redhat1 product
- fedora_corecore_2.0 | core_3.0
Trustix1 product
- secure_linux2.0 | 2.1 | 2.2
Ubuntu1 product
- ubuntu_linux4.1
7 vendors · 7 products
References
11 links
- security.e-matters.de/advisories/152004.htmlX Refsource MISC
- asg.web.cmu.edu/cyrus/download/imapd/changes.htmlX Refsource CONFIRM
- asg.web.cmu.edu/archive/message.php?mailbox=archive.cyrus-announce&msg=143Mailing ListX Refsource MLIST