CVE-2002-1580
highpriority · attend · 46EPSS 0.165 · 97 %ileexploit · functionalEUUSEPSS · scored 2026-10-27
Integer overflow in imapparse.c for Cyrus IMAP server 1.4 and 2.1.10 allows remote attackers to execute arbitrary code via a large length value that facilitates a buffer overflow attack, a different vulnerability than CVE-2002-1347.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 6.8–7.5
weaknesses
The CWE weakness classes this flaw belongs to.
exploits (1)
Public proof-of-concept and weaponised exploit code.
- EDB-22061Cyrus IMAPD 1.4/1.5.19/2.0.12/2.0.16/2.1.9/2.1.10 - Pre-Login Heap Corruptionfunctional · exploit_db
affected products (7)
Products and version ranges known to be affected.
- carnegie mellon university cyrus imap server= 1.4nvdUScpe:2.3:a:carnegie_mellon_university:cyrus_imap_server:*:*:*:*:*:*:*:*
- carnegie mellon university cyrus imap server= 1.5.19nvdUScpe:2.3:a:carnegie_mellon_university:cyrus_imap_server:*:*:*:*:*:*:*:*
- carnegie mellon university cyrus imap server= 2.0.12nvdUScpe:2.3:a:carnegie_mellon_university:cyrus_imap_server:*:*:*:*:*:*:*:*
- carnegie mellon university cyrus imap server= 2.0.16nvdUScpe:2.3:a:carnegie_mellon_university:cyrus_imap_server:*:*:*:*:*:*:*:*
- carnegie mellon university cyrus imap server= 2.1.10nvdUScpe:2.3:a:carnegie_mellon_university:cyrus_imap_server:*:*:*:*:*:*:*:*
- carnegie mellon university cyrus imap server= 2.1.9nvdUScpe:2.3:a:carnegie_mellon_university:cyrus_imap_server:*:*:*:*:*:*:*:*
also known as (2)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (16)
External citations — patches, advisories, analysis.
- http://asg.web.cmu.edu/cyrus/download/imapd/changes.htmlenisa_euvd
- http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000557enisa_euvd
- http://distro.conectiva.com/atualizacoes/?id=a&anuncio=000557enisa_euvd
- http://www.debian.org/security/2002/dsa-215enisa_euvd
- http://www.kb.cert.org/vuls/id/740169enisa_euvd
- http://www.securityfocus.com/archive/1/301864enisa_euvd
- http://www.securityfocus.com/bid/6298enisa_euvd
- https://exchange.xforce.ibmcloud.com/vulnerabilities/10744enisa_euvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan