CVE-2004-1067: Carnegie Mellon University Cyrus Imap Server

High severity, CVSS 10.0. EPSS: 5.2% chance of exploitation in the next 30 days.

Off-by-one error in the mysasl_canon_user function in Cyrus IMAP Server 2.2.9 and earlier leads to a buffer overflow, which may allow remote attackers to execute arbitrary code via the username.

Affected products

• Carnegie Mellon University Cyrus Imap Server: version 1.4 only; version 1.5.19 only; version 2.0.12 only; version 2.0.16 only; version 2.1.7 only; version 2.1.9 only; …
• Red Hat Fedora Core: version core_2.0 only; version core_3.0 only
• Ubuntu Ubuntu Linux: version 4.1 only

Published 2005-01-10. Last modified 2026-06-16.