CVE-2004-0224: Double Precision Incorporated Courier MTA

High severity, CVSS 7.5. EPSS: 3.3% chance of exploitation in the next 30 days.

Multiple buffer overflows in (1) iso2022jp.c or (2) shiftjis.c for Courier-IMAP before 3.0.0, Courier before 0.45, and SqWebMail before 4.0.0 may allow remote attackers to execute arbitrary code "when Unicode character is out of BMP range."

Affected products

• Double Precision Incorporated Courier MTA: version 0.43 only; version 0.43.1 only; version 0.43.2 only; version 0.44 only; version 0.44.2 only
• Double Precision Incorporated Sqwebmail: version 3.5.2 only; version 3.5.3 only; version 3.6.1 only; version 3.6.2 only; version 3.6_.0 only
• Gentoo Linux: version 1.4 only
• INTER7 Courier-Imap: version 1.6 only; version 1.7 only; version 2.0.0 only; version 2.1 only; version 2.1.1 only; version 2.1.2 only; …

Published 2004-04-15. Last modified 2026-06-16.