Cyrus IMAP 2.5.x before 2.5.14 and 3.x before 3.0.12 allows privilege escalation because an HTTP request may be interpreted in the authentication context of an unrelated previous request that arrived over the same connection.
{ "binaries": [ { "binary_name": "cyrus-admin", "binary_version": "2.5.10-3ubuntu1.1+esm1" }, { "binary_name": "cyrus-caldav", "binary_version": "2.5.10-3ubuntu1.1+esm1" }, { "binary_name": "cyrus-caldav-dbgsym", "binary_version": "2.5.10-3ubuntu1.1+esm1" }, { "binary_name": "cyrus-clients", "binary_version": "2.5.10-3ubuntu1.1+esm1" }, { "binary_name": "cyrus-clients-dbgsym", "binary_version": "2.5.10-3ubuntu1.1+esm1" }, { "binary_name": "cyrus-common", "binary_version": "2.5.10-3ubuntu1.1+esm1" }, { "binary_name": "cyrus-common-dbgsym", "binary_version": "2.5.10-3ubuntu1.1+esm1" }, { "binary_name": "cyrus-dev", "binary_version": "2.5.10-3ubuntu1.1+esm1" }, { "binary_name": "cyrus-doc", "binary_version": "2.5.10-3ubuntu1.1+esm1" }, { "binary_name": "cyrus-imapd", "binary_version": "2.5.10-3ubuntu1.1+esm1" }, { "binary_name": "cyrus-imapd-dbgsym", "binary_version": "2.5.10-3ubuntu1.1+esm1" }, { "binary_name": "cyrus-murder", "binary_version": "2.5.10-3ubuntu1.1+esm1" }, { "binary_name": "cyrus-murder-dbgsym", "binary_version": "2.5.10-3ubuntu1.1+esm1" }, { "binary_name": "cyrus-nntpd", "binary_version": "2.5.10-3ubuntu1.1+esm1" }, { "binary_name": "cyrus-nntpd-dbgsym", "binary_version": "2.5.10-3ubuntu1.1+esm1" }, { "binary_name": "cyrus-pop3d", "binary_version": "2.5.10-3ubuntu1.1+esm1" }, { "binary_name": "cyrus-pop3d-dbgsym", "binary_version": "2.5.10-3ubuntu1.1+esm1" }, { "binary_name": "cyrus-replication", "binary_version": "2.5.10-3ubuntu1.1+esm1" }, { "binary_name": "cyrus-replication-dbgsym", "binary_version": "2.5.10-3ubuntu1.1+esm1" }, { "binary_name": "libcyrus-imap-perl", "binary_version": "2.5.10-3ubuntu1.1+esm1" }, { "binary_name": "libcyrus-imap-perl-dbgsym", "binary_version": "2.5.10-3ubuntu1.1+esm1" } ], "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro", "ubuntu_priority": "medium" }
{ "binaries": [ { "binary_name": "cyrus-admin", "binary_version": "3.0.12-1" }, { "binary_name": "cyrus-caldav", "binary_version": "3.0.12-1" }, { "binary_name": "cyrus-caldav-dbgsym", "binary_version": "3.0.12-1" }, { "binary_name": "cyrus-clients", "binary_version": "3.0.12-1" }, { "binary_name": "cyrus-clients-dbgsym", "binary_version": "3.0.12-1" }, { "binary_name": "cyrus-common", "binary_version": "3.0.12-1" }, { "binary_name": "cyrus-common-dbgsym", "binary_version": "3.0.12-1" }, { "binary_name": "cyrus-dev", "binary_version": "3.0.12-1" }, { "binary_name": "cyrus-doc", "binary_version": "3.0.12-1" }, { "binary_name": "cyrus-imapd", "binary_version": "3.0.12-1" }, { "binary_name": "cyrus-imapd-dbgsym", "binary_version": "3.0.12-1" }, { "binary_name": "cyrus-murder", "binary_version": "3.0.12-1" }, { "binary_name": "cyrus-murder-dbgsym", "binary_version": "3.0.12-1" }, { "binary_name": "cyrus-nntpd", "binary_version": "3.0.12-1" }, { "binary_name": "cyrus-nntpd-dbgsym", "binary_version": "3.0.12-1" }, { "binary_name": "cyrus-pop3d", "binary_version": "3.0.12-1" }, { "binary_name": "cyrus-pop3d-dbgsym", "binary_version": "3.0.12-1" }, { "binary_name": "cyrus-replication", "binary_version": "3.0.12-1" }, { "binary_name": "cyrus-replication-dbgsym", "binary_version": "3.0.12-1" }, { "binary_name": "libcyrus-imap-perl", "binary_version": "3.0.12-1" }, { "binary_name": "libcyrus-imap-perl-dbgsym", "binary_version": "3.0.12-1" } ], "availability": "No subscription required", "ubuntu_priority": "medium" }