CVE-2021-44143

A flaw was found in mbsync in isync 1.4.0 through 1.4.3. Due to an unchecked condition, a malicious or compromised IMAP server could use a crafted mail message that lacks headers (i.e., one that starts with an empty line) to provoke a heap overflow, which could conceivably be exploited for remote code execution.

• CWE-787

• http://www.openwall.com/lists/oss-security/2021/12/03/2Mailing List
• https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=999804Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CYZ2GNB4ZO2T27D2XNUWMCS3THZYSJQU/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LCBSY7OZ57XNC6ZYXF6WU5KBSWITZVDX/
• https://security.gentoo.org/glsa/202208-15Third Party Advisory
• https://sourceforge.net/p/isync/isync/commit_browserPatch, Third Party Advisory
• https://sourceforge.net/p/isync/isync/ref/master/tags/Third Party Advisory
• http://www.openwall.com/lists/oss-security/2021/12/03/2Mailing List
• https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=999804Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CYZ2GNB4ZO2T27D2XNUWMCS3THZYSJQU/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LCBSY7OZ57XNC6ZYXF6WU5KBSWITZVDX/
• https://security.gentoo.org/glsa/202208-15Third Party Advisory
• https://sourceforge.net/p/isync/isync/commit_browserPatch, Third Party Advisory
• https://sourceforge.net/p/isync/isync/ref/master/tags/Third Party Advisory

Published

Nov 22, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-44138There is a Directory traversal vulnerability in Caucho Resin…7.5
• CVE-2021-44139Sentinel 1.8.2 is vulnerable to Server-side request forgery …7.5
• CVE-2021-4414The Abandoned Cart Lite for WooCommerce plugin for WordPress…4.3
• CVE-2021-44140Remote attackers may delete arbitrary files in a system host…9.1
• CVE-2021-44141All versions of Samba prior to 4.15.5 are vulnerable to a ma…4.3
• CVE-2021-44142The Samba vfs_fruit module uses extended file attributes (EA…8.8
• CVE-2021-44144Croatia Control Asterix 2.8.1 has a heap-based buffer over-r…9.1
• CVE-2021-44145In the TransformXML processor of Apache NiFi before 1.15.1 a…6.5
• CVE-2021-44147An XML External Entity issue in Claris FileMaker Pro and Ser…5.5
• CVE-2021-44148GL.iNet GL-AR150 2.x before 3.x devices, configured as repea…6.1
• CVE-2021-44149An issue was discovered in Trusted Firmware OP-TEE Trusted O…7.8
• CVE-2021-4415The Sunshine Photo Cart plugin for WordPress is vulnerable t…4.3