CVE-2011-3208

Stack-based buffer overflow in the split_wildmats function in nntpd.c in nntpd in Cyrus IMAP Server before 2.3.17 and 2.4.x before 2.4.11 allows remote attackers to execute arbitrary code via a crafted NNTP command.

• CWE-119

• http://asg.andrew.cmu.edu/archive/message.php?mailbox=archive.cyrus-announce&msg=199
• http://asg.andrew.cmu.edu/archive/message.php?mailbox=archive.cyrus-announce&msg=200
• http://git.cyrusimap.org/cyrus-imapd/commit/?id=0f8f026699829b65733c3081657b24e2174f4f4dPatch
• http://git.cyrusimap.org/cyrus-imapd/commit/?id=3244c18c928fa331f6927e2b8146abe90feafdddPatch
• http://lists.opensuse.org/opensuse-updates/2011-09/msg00019.html
• http://secunia.com/advisories/45938Vendor Advisory
• http://secunia.com/advisories/45975Vendor Advisory
• http://secunia.com/advisories/46064Vendor Advisory
• http://securitytracker.com/id?1026031
• http://www.debian.org/security/2011/dsa-2318
• http://www.mandriva.com/security/advisories?name=MDVSA-2011:149
• http://www.osvdb.org/75307
• http://www.redhat.com/support/errata/RHSA-2011-1317.html
• http://www.securityfocus.com/bid/49534
• https://bugzilla.redhat.com/show_bug.cgi?id=734926Patch
• https://exchange.xforce.ibmcloud.com/vulnerabilities/69679
• https://hermes.opensuse.org/messages/11723935
• http://asg.andrew.cmu.edu/archive/message.php?mailbox=archive.cyrus-announce&msg=199
• http://asg.andrew.cmu.edu/archive/message.php?mailbox=archive.cyrus-announce&msg=200
• http://git.cyrusimap.org/cyrus-imapd/commit/?id=0f8f026699829b65733c3081657b24e2174f4f4dPatch
• http://git.cyrusimap.org/cyrus-imapd/commit/?id=3244c18c928fa331f6927e2b8146abe90feafdddPatch
• http://lists.opensuse.org/opensuse-updates/2011-09/msg00019.html
• http://secunia.com/advisories/45938Vendor Advisory
• http://secunia.com/advisories/45975Vendor Advisory
• http://secunia.com/advisories/46064Vendor Advisory
• http://securitytracker.com/id?1026031
• http://www.debian.org/security/2011/dsa-2318
• http://www.mandriva.com/security/advisories?name=MDVSA-2011:149
• http://www.osvdb.org/75307
• http://www.redhat.com/support/errata/RHSA-2011-1317.html
• http://www.securityfocus.com/bid/49534
• https://bugzilla.redhat.com/show_bug.cgi?id=734926Patch
• https://exchange.xforce.ibmcloud.com/vulnerabilities/69679
• https://hermes.opensuse.org/messages/11723935

Published

Sep 14, 2011

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2011-3202A Cross-Site Scripting (XSS) vulnerability exists in the g p…6.1
• CVE-2011-3203A Code Execution vulnerability exists the attachment paramet…9.8
• CVE-2011-3204hammerhead.cc in Hammerhead 2.1.4 allows local users to writ…
• CVE-2011-3205Buffer overflow in the gopherToHTML function in gopher.cc in…
• CVE-2011-3206Multiple cross-site scripting (XSS) vulnerabilities in the a…
• CVE-2011-3207crypto/x509/x509_vfy.c in OpenSSL 1.0.x before 1.0.0e does n…
• CVE-2011-3209The div_long_long_rem implementation in include/asm-x86/div6…
• CVE-2011-3210The ephemeral ECDH ciphersuite functionality in OpenSSL 0.9.…
• CVE-2011-3211The server in Bcfg2 1.1.2 and earlier, and 1.2 prerelease, a…
• CVE-2011-3212CoreStorage in Apple Mac OS X 10.7 before 10.7.2 does not en…
• CVE-2011-3213The File Systems component in Apple Mac OS X before 10.7.2 d…
• CVE-2011-3214IOGraphics in Apple Mac OS X through 10.6.8 does not properl…