Vulnerability Details CVE-2021-3657
A flaw was found in mbsync versions prior to 1.4.4. Due to inadequate handling of extremely large (>=2GiB) IMAP literals, malicious or compromised IMAP servers, and hypothetically even external email senders, could cause several different buffer overflows, which could conceivably be exploited for remote code execution.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.031
EPSS Ranking 86.2%
CVSS Severity
CVSS v3 Score 9.8
CVSS v2 Score 7.5
References
- https://bugzilla.redhat.com/show_bug.cgi?id=2028932
- https://lists.debian.org/debian-lts-announce/2022/07/msg00001.html
- https://security.gentoo.org/glsa/202208-15
- https://www.openwall.com/lists/oss-security/2021/12/03/1
- https://bugzilla.redhat.com/show_bug.cgi?id=2028932
- https://lists.debian.org/debian-lts-announce/2022/07/msg00001.html
- https://security.gentoo.org/glsa/202208-15
- https://www.openwall.com/lists/oss-security/2021/12/03/1
Products affected by CVE-2021-3657
-
cpe:2.3:a:isync_project:isync:0.1
-
cpe:2.3:a:isync_project:isync:0.2
-
cpe:2.3:a:isync_project:isync:0.3
-
cpe:2.3:a:isync_project:isync:0.4
-
cpe:2.3:a:isync_project:isync:0.5
-
cpe:2.3:a:isync_project:isync:0.6
-
cpe:2.3:a:isync_project:isync:0.7
-
cpe:2.3:a:isync_project:isync:0.8
-
cpe:2.3:a:isync_project:isync:1.0.0
-
cpe:2.3:a:isync_project:isync:1.0.1
-
cpe:2.3:a:isync_project:isync:1.0.2
-
cpe:2.3:a:isync_project:isync:1.0.3
-
cpe:2.3:a:isync_project:isync:1.0.4
-
cpe:2.3:a:isync_project:isync:1.0.5
-
cpe:2.3:a:isync_project:isync:1.0.6
-
cpe:2.3:a:isync_project:isync:1.1.0
-
cpe:2.3:a:isync_project:isync:1.1.1
-
cpe:2.3:a:isync_project:isync:1.1.2
-
cpe:2.3:a:isync_project:isync:1.1.3
-
cpe:2.3:a:isync_project:isync:1.2.0
-
cpe:2.3:a:isync_project:isync:1.2.1
-
cpe:2.3:a:isync_project:isync:1.2.2
-
cpe:2.3:a:isync_project:isync:1.2.3
-
cpe:2.3:a:isync_project:isync:1.3.0
-
cpe:2.3:a:isync_project:isync:1.3.1
-
cpe:2.3:a:isync_project:isync:1.3.2
-
cpe:2.3:a:isync_project:isync:1.3.3
-
cpe:2.3:a:isync_project:isync:1.3.4
-
cpe:2.3:a:isync_project:isync:1.3.5
-
cpe:2.3:a:isync_project:isync:1.3.6
-
cpe:2.3:a:isync_project:isync:1.4.0
-
cpe:2.3:a:isync_project:isync:1.4.1
-
cpe:2.3:a:isync_project:isync:1.4.2
-
cpe:2.3:a:isync_project:isync:1.4.3
-
cpe:2.3:o:debian:debian_linux:9.0
-
cpe:2.3:o:fedoraproject:fedora:35
-
cpe:2.3:o:redhat:enterprise_linux:7.0