Launchpad CVE tracker

CVE 2009-0688

Multiple buffer overflows in the CMU Cyrus SASL library before 2.1.23 might allow remote attackers to execute arbitrary code or cause a denial of service (application crash) via strings that are used as input to the sasl_encode64 function in lib/saslutil.c.

Related bugs and status

CVE-2009-0688 (Candidate) is related to these bugs:

Bug #383300: cyrus-sasl2 buffer overflow vulnerability: CVE-2009-0688

		In	Importance	Status
383300	cyrus-sasl2 buffer overflow vulnerability: CVE-2009-0688	cyrus-sasl2 (Ubuntu)	Medium	Fix Released
383300	cyrus-sasl2 buffer overflow vulnerability: CVE-2009-0688	cyrus-sasl2 (Debian)	Unknown	Fix Released
383300	cyrus-sasl2 buffer overflow vulnerability: CVE-2009-0688	cyrus-sasl2 (Ubuntu Dapper)	Medium	Fix Released
383300	cyrus-sasl2 buffer overflow vulnerability: CVE-2009-0688	cyrus-sasl2 (Ubuntu Hardy)	Medium	Fix Released
383300	cyrus-sasl2 buffer overflow vulnerability: CVE-2009-0688	cyrus-sasl2 (Ubuntu Intrepid)	Medium	Fix Released
383300	cyrus-sasl2 buffer overflow vulnerability: CVE-2009-0688	cyrus-sasl2 (Ubuntu Jaunty)	Medium	Fix Released
383300	cyrus-sasl2 buffer overflow vulnerability: CVE-2009-0688	cyrus-sasl2 (Ubuntu Karmic)	Medium	Fix Released

Bug #391982: Dependencies out of sync between libsasl2-modules-gssapi-heimdal and libsasl2-modules in Hardy Heron

Summary				In	Importance	Status
	391982	Dependencies out of sync between libsasl2-modules-gssapi-heimdal and libsasl2-modules in Hardy Heron		cyrus-sasl2-heimdal (Ubuntu)	Undecided	Confirmed

Bug #392353: Update libsasl2 to fix security vulnerability

Summary				In	Importance	Status
	392353	Update libsasl2 to fix security vulnerability		The Dell Mini Project	Undecided	Confirmed

See the

CVE page on Mitre.org for more details.

Launchpad.net

CVE 2009-0688

References