CVE-2004-1011: Carnegie Mellon University Cyrus Imap Server

High severity, CVSS 10.0. EPSS: 5.8% chance of exploitation in the next 30 days.

Stack-based buffer overflow in Cyrus IMAP Server 2.2.4 through 2.2.8, with the imapmagicplus option enabled, allows remote attackers to execute arbitrary code via a long (1) PROXY or (2) LOGIN command, a different vulnerability than CVE-2004-1015.

Affected products

• Carnegie Mellon University Cyrus Imap Server: version 2.1.7 only; version 2.1.9 only; version 2.1.10 only; version 2.1.16 only; version 2.2.0_alpha only; version 2.2.1_beta only; …
• Conectiva Linux: version 9.0 only; version 10.0 only
• Openpkg Openpkg: version current only
• Red Hat Fedora Core: version core_2.0 only; version core_3.0 only
• Trustix Secure Linux: version 2.0 only; version 2.1 only; version 2.2 only
• Ubuntu Ubuntu Linux: version 4.1 only

Published 2005-01-10. Last modified 2026-06-16.