CVE-2017-14230

In the mboxlist_do_find function in imap/mboxlist.c in Cyrus IMAP before 3.0.4, an off-by-one error in prefix calculation for the LIST command caused use of uninitialized memory, which might allow remote attackers to obtain sensitive information or cause a denial of service (daemon crash) via a 'LIST "" "Other Users"' command.

• CWE-20

• https://github.com/cyrusimap/cyrus-imapd/commit/6bd33275368edfa71ae117de895488584678ac79Issue Tracking, Patch, Third Party Advisory
• https://github.com/cyrusimap/cyrus-imapd/issues/2132Issue Tracking, Third Party Advisory
• https://lists.andrew.cmu.edu/pipermail/cyrus-announce/2017-September/000145.htmlThird Party Advisory
• https://www.cyrusimap.org/imap/download/release-notes/3.0/x/3.0.4.htmlRelease Notes, Third Party Advisory
• https://github.com/cyrusimap/cyrus-imapd/commit/6bd33275368edfa71ae117de895488584678ac79Issue Tracking, Patch, Third Party Advisory
• https://github.com/cyrusimap/cyrus-imapd/issues/2132Issue Tracking, Third Party Advisory
• https://lists.andrew.cmu.edu/pipermail/cyrus-announce/2017-September/000145.htmlThird Party Advisory
• https://www.cyrusimap.org/imap/download/release-notes/3.0/x/3.0.4.htmlRelease Notes, Third Party Advisory

Published

Sep 10, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-14225The av_color_primaries_name function in libavutil/pixdesc.c …
• CVE-2017-14226WP1StylesListener.cpp, WP5StylesListener.cpp, and WP42Styles…7.5
• CVE-2017-14227In MongoDB libbson 1.7.0, the bson_iter_codewscope function …
• CVE-2017-14228In Netwide Assembler (NASM) 2.14rc0, there is an illegal add…
• CVE-2017-14229There is an infinite loop in the jpc_dec_tileinit function i…
• CVE-2017-1423IBM WebSphere Portal 8.5 and 9.0 exposes backend server URLs…
• CVE-2017-14231GeniXCMS before 1.1.0 allows remote attackers to cause a den…
• CVE-2017-14232The read_chunk function in flif-dec.cpp in Free Lossless Ima…
• CVE-2017-14238SQL injection vulnerability in admin/menus/edit.php in Dolib…
• CVE-2017-14239Multiple cross-site scripting (XSS) vulnerabilities in Dolib…
• CVE-2017-1424IBM Business Process Manager 8.5.7 is vulnerable to cross-si…
• CVE-2017-14240There is a sensitive information disclosure vulnerability in…