CVE-2014-0079 The ValidateUserLogon function in provider/libserver/ECSession.cpp in Zarafa 7.1.8, 6.20.0, and earlier, when using certain build conditions, allows remote attackers to cause a denial of service (cras...
MediumCVSS 5.0
EPSS 1.8%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The ValidateUserLogon function in provider/libserver/ECSession.cpp in Zarafa 7.1.8, 6.20.0, and earlier, when using certain build conditions, allows remote attackers to cause a denial of service (crash) via vectors related to "a NULL pointer of the password."
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| zarafa | <= 6.20 | No fix listed |
| zarafa | = 5.00 | No fix listed |
| zarafa | = 5.01 | No fix listed |
| zarafa | = 5.02 | No fix listed |
| zarafa | = 5.10 | No fix listed |
| zarafa | = 5.11 | No fix listed |
| zarafa | = 5.20 | No fix listed |
| zarafa | = 5.22 | No fix listed |
| zarafa | = 6.00 | No fix listed |
| zarafa | = 6.01 | No fix listed |
| zarafa | = 6.02 | No fix listed |
| zarafa | = 6.03 | No fix listed |
| zarafa | = 6.10 | No fix listed |
| zarafa | = 6.11 | No fix listed |
| zarafa | = 7.1.8 | No fix listed |
References
- MDVSA-2014:044 vendor-advisory
- bugzilla.redhat.com