CVE-2015-8076

The index_urlfetch function in index.c in Cyrus IMAP 2.3.x before 2.3.19, 2.4.x before 2.4.18, 2.5.x before 2.5.4 allows remote attackers to obtain sensitive information or possibly have unspecified other impact via vectors related to the urlfetch range, which triggers an out-of-bounds heap read.

• CWE-119
• CWE-200

• http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00066.html
• http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00000.html
• http://lists.opensuse.org/opensuse-updates/2015-09/msg00037.html
• http://lists.opensuse.org/opensuse-updates/2015-09/msg00038.html
• http://www.openwall.com/lists/oss-security/2015/09/29/2
• http://www.openwall.com/lists/oss-security/2015/09/30/3
• http://www.openwall.com/lists/oss-security/2015/11/04/3
• https://cyrus.foundation/cyrus-imapd/commit/?id=07de4ff1bf2fa340b9d77b8e7de8d43d47a33921
• https://cyrus.foundation/cyrus-imapd/commit/?id=c21e179c1f6b968fe69bebe079176714e511587bVendor Advisory
• https://docs.cyrus.foundation/imap/release-notes/2.3/x/2.3.19.html
• https://docs.cyrus.foundation/imap/release-notes/2.4/x/2.4.18.htmlVendor Advisory
• https://docs.cyrus.foundation/imap/release-notes/2.5/x/2.5.4.htmlVendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00066.html
• http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00000.html
• http://lists.opensuse.org/opensuse-updates/2015-09/msg00037.html
• http://lists.opensuse.org/opensuse-updates/2015-09/msg00038.html
• http://www.openwall.com/lists/oss-security/2015/09/29/2
• http://www.openwall.com/lists/oss-security/2015/09/30/3
• http://www.openwall.com/lists/oss-security/2015/11/04/3
• https://cyrus.foundation/cyrus-imapd/commit/?id=07de4ff1bf2fa340b9d77b8e7de8d43d47a33921
• https://cyrus.foundation/cyrus-imapd/commit/?id=c21e179c1f6b968fe69bebe079176714e511587bVendor Advisory
• https://docs.cyrus.foundation/imap/release-notes/2.3/x/2.3.19.html
• https://docs.cyrus.foundation/imap/release-notes/2.4/x/2.4.18.htmlVendor Advisory
• https://docs.cyrus.foundation/imap/release-notes/2.5/x/2.5.4.htmlVendor Advisory

Published

Dec 3, 2015

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2015-8070Use-after-free vulnerability in Adobe Flash Player before 18…
• CVE-2015-8071Use-after-free vulnerability in Adobe Flash Player before 18…
• CVE-2015-8072mediaserver in Android 4.4 through 5.x before 5.1.1 LMY48X a…
• CVE-2015-8073mediaserver in Android 4.4 and 5.1 before 5.1.1 LMY48X allow…
• CVE-2015-8074mediaserver in Android before 5.1.1 LMY48X allows remote att…
• CVE-2015-8075Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2015-8077Integer overflow in the index_urlfetch function in imap/inde…
• CVE-2015-8078Integer overflow in the index_urlfetch function in imap/inde…
• CVE-2015-8079qt5-qtwebkit before 5.4 records private browsing URLs to its…5.3
• CVE-2015-8080Integer overflow in the getnum function in lua_struct.c in R…7.5
• CVE-2015-8081The Field as Block module 7.x-1.x before 7.x-1.4 for Drupal …
• CVE-2015-8082The Login Disable module 6.x-1.x before 6.x-1.1 and 7.x-1.x …