CVE-2019-11356

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2019-11356
The CalDAV feature in httpd in Cyrus IMAP 2.5.x through 2.5.12 and 3.0.x through 3.0.9 allows remote attackers to execute arbitrary code via a crafted HTTP PUT operation for an event with a long iCalendar property name.

9.8 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

7.5 /10

CVSS v2.0 : HIGH

V2 Legend

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References
Link Resource
https://access.redhat.com/errata/RHSA-2019:1771 Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IGO43JS7IFDNITHXOOHOP6JHRKRDIYY6/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PICSZDC3UGEUZ27VXGGM6OFI67D3KKLZ/
https://seclists.org/bugtraq/2019/Jun/9 Mailing List Third Party Advisory
https://usn.ubuntu.com/4566-1/ Third Party Advisory
https://www.cyrusimap.org/imap/download/release-notes/2.5/index.html Release Notes Vendor Advisory
https://www.cyrusimap.org/imap/download/release-notes/2.5/x/2.5.13.html Release Notes Vendor Advisory
https://www.cyrusimap.org/imap/download/release-notes/3.0/index.html Release Notes Vendor Advisory
https://www.cyrusimap.org/imap/download/release-notes/3.0/x/3.0.10.html Release Notes Vendor Advisory
https://www.debian.org/security/2019/dsa-4458 Third Party Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:cyrus:imap:*:*:*:*:*:*:*:*
cpe:2.3:a:cyrus:imap:*:*:*:*:*:*:*:*

Configuration 2 (hide)

OR cpe:2.3:o:fedoraproject:fedora:29:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*

Configuration 3 (hide)

cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*

Configuration 4 (hide)

cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*

Configuration 5 (hide)

OR cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_eus:8.1:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_eus:8.2:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_eus:8.4:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_aus:8.2:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_aus:8.4:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_tus:8.2:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_tus:8.4:*:*:*:*:*:*:*
History

07 Nov 2023, 03:02

Type Values Removed Values Added
References
  • {'url': 'https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IGO43JS7IFDNITHXOOHOP6JHRKRDIYY6/', 'name': 'FEDORA-2019-309f559057', 'tags': ['Mailing List', 'Third Party Advisory'], 'refsource': 'FEDORA'}
  • {'url': 'https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PICSZDC3UGEUZ27VXGGM6OFI67D3KKLZ/', 'name': 'FEDORA-2019-f0435555ac', 'tags': ['Mailing List', 'Third Party Advisory'], 'refsource': 'FEDORA'}
  • () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IGO43JS7IFDNITHXOOHOP6JHRKRDIYY6/ -
  • () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PICSZDC3UGEUZ27VXGGM6OFI67D3KKLZ/ -

03 May 2022, 14:27

Type Values Removed Values Added
CPE cpe:2.3:o:fedoraproject:fedora:29:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_tus:8.4:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_tus:8.2:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_eus:8.2:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_eus:8.1:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_eus:8.4:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_aus:8.2:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_aus:8.4:*:*:*:*:*:*:*
CWE CWE-119 CWE-787
References (FEDORA) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IGO43JS7IFDNITHXOOHOP6JHRKRDIYY6/ - (FEDORA) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IGO43JS7IFDNITHXOOHOP6JHRKRDIYY6/ - Mailing List, Third Party Advisory
References (FEDORA) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PICSZDC3UGEUZ27VXGGM6OFI67D3KKLZ/ - (FEDORA) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PICSZDC3UGEUZ27VXGGM6OFI67D3KKLZ/ - Mailing List, Third Party Advisory
References (REDHAT) https://access.redhat.com/errata/RHSA-2019:1771 - (REDHAT) https://access.redhat.com/errata/RHSA-2019:1771 - Third Party Advisory
References (BUGTRAQ) https://seclists.org/bugtraq/2019/Jun/9 - (BUGTRAQ) https://seclists.org/bugtraq/2019/Jun/9 - Mailing List, Third Party Advisory
References (DEBIAN) https://www.debian.org/security/2019/dsa-4458 - (DEBIAN) https://www.debian.org/security/2019/dsa-4458 - Third Party Advisory
References (UBUNTU) https://usn.ubuntu.com/4566-1/ - (UBUNTU) https://usn.ubuntu.com/4566-1/ - Third Party Advisory
First Time Debian debian Linux
Fedoraproject
Debian
Redhat enterprise Linux Server Tus
Redhat enterprise Linux Eus
Canonical ubuntu Linux
Redhat enterprise Linux Server Aus
Fedoraproject fedora
Redhat enterprise Linux
Canonical
Redhat
Information

Published : 2019-06-03 20:29

Updated : 2023-12-10 12:59

NVD link : CVE-2019-11356

Mitre link : CVE-2019-11356

CVE.ORG link : CVE-2019-11356

JSON object : View

Products Affected

redhat

  • enterprise_linux
  • enterprise_linux_eus
  • enterprise_linux_server_tus
  • enterprise_linux_server_aus

canonical

  • ubuntu_linux

cyrus

  • imap

debian

  • debian_linux

fedoraproject

  • fedora
CWE
CWE-787

Out-of-bounds Write