CVE-2021-44143

A flaw was found in mbsync in isync 1.4.0 through 1.4.3. Due to an unchecked condition, a malicious or compromised IMAP server could use a crafted mail message that lacks headers (i.e., one that starts with an empty line) to provoke a heap overflow, which could conceivably be exploited for remote code execution.

Link	Resource
https://sourceforge.net/p/isync/isync/commit_browser	Patch Third Party Advisory
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=999804	Third Party Advisory
https://sourceforge.net/p/isync/isync/ref/master/tags/	Third Party Advisory
http://www.openwall.com/lists/oss-security/2021/12/03/2	Mailing List
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CYZ2GNB4ZO2T27D2XNUWMCS3THZYSJQU/	Mailing List Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LCBSY7OZ57XNC6ZYXF6WU5KBSWITZVDX/	Mailing List Third Party Advisory
https://security.gentoo.org/glsa/202208-15	Third Party Advisory

Configuration 1

cpe:2.3:a:isync_project:isync:*:*:*:*:*:*:*:* cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:* cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*

---

Published : 2021-11-22 08:15

Updated : 2022-10-25 08:50

---

NVD link : CVE-2021-44143

Mitre link : CVE-2021-44143

No products.

CWE-787