Read the docs
TI-2015-06719 Aliases CVE-2015-8076GHSA-fxwg-gpw8-9wrp

The index_urlfetch function in index.c in Cyrus IMAP 2.3.x before 2.3.19, 2.4.x before…

Priority LOW 39CWE-119Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Low
Impact type
Code execution, Information disclosure
Confidentiality · integrity · availability
Partial · Partial · Partial
Fix status
Will not fix Red Hat: no fix planned

Attack profile from CVSS 2.0 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-119, CWE-200 and the CVSS impact.

Summary

The index_urlfetch function in index.c in Cyrus IMAP 2.3.x before 2.3.19, 2.4.x before 2.4.18, 2.5.x before 2.5.4 allows remote attackers to obtain sensitive information or possibly have unspecified other impact via vectors related to the urlfetch range, which triggers an out-of-bounds heap read.

Why it matters now

EPSS 0.03261 88th percentileScored 2026-11-07
Fix Will not fix Red Hat: no fix planned

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 43

CPEVersionsRoleVendor
cpe:2.3:o:opensuse:leap:42.1:*:*:*:*:*:*:*42.1VulnerableopenSUSE
cpe:2.3:o:opensuse:opensuse:13.2:*:*:*:*:*:*:*13.2VulnerableopenSUSE
cpe:2.3:a:cyrus:imap:2.3.0:*:*:*:*:*:*:*2.3.0VulnerableCyrus
cpe:2.3:a:cyrus:imap:2.3.1:*:*:*:*:*:*:*2.3.1VulnerableCyrus
cpe:2.3:a:cyrus:imap:2.3.2:*:*:*:*:*:*:*2.3.2VulnerableCyrus
cpe:2.3:a:cyrus:imap:2.3.3:*:*:*:*:*:*:*2.3.3VulnerableCyrus
cpe:2.3:a:cyrus:imap:2.3.4:*:*:*:*:*:*:*2.3.4VulnerableCyrus
cpe:2.3:a:cyrus:imap:2.3.5:*:*:*:*:*:*:*2.3.5VulnerableCyrus
cpe:2.3:a:cyrus:imap:2.3.6:*:*:*:*:*:*:*2.3.6VulnerableCyrus
cpe:2.3:a:cyrus:imap:2.3.7:*:*:*:*:*:*:*2.3.7VulnerableCyrus
  • cpe:2.3:o:opensuse:leap:42.1:*:*:*:*:*:*:* Versions 42.1 Vulnerable ·openSUSE
  • cpe:2.3:o:opensuse:opensuse:13.2:*:*:*:*:*:*:* Versions 13.2 Vulnerable ·openSUSE
  • cpe:2.3:a:cyrus:imap:2.3.0:*:*:*:*:*:*:* Versions 2.3.0 Vulnerable ·Cyrus
  • cpe:2.3:a:cyrus:imap:2.3.1:*:*:*:*:*:*:* Versions 2.3.1 Vulnerable ·Cyrus
  • cpe:2.3:a:cyrus:imap:2.3.2:*:*:*:*:*:*:* Versions 2.3.2 Vulnerable ·Cyrus
  • cpe:2.3:a:cyrus:imap:2.3.3:*:*:*:*:*:*:* Versions 2.3.3 Vulnerable ·Cyrus
  • cpe:2.3:a:cyrus:imap:2.3.4:*:*:*:*:*:*:* Versions 2.3.4 Vulnerable ·Cyrus
  • cpe:2.3:a:cyrus:imap:2.3.5:*:*:*:*:*:*:* Versions 2.3.5 Vulnerable ·Cyrus
  • cpe:2.3:a:cyrus:imap:2.3.6:*:*:*:*:*:*:* Versions 2.3.6 Vulnerable ·Cyrus
  • cpe:2.3:a:cyrus:imap:2.3.7:*:*:*:*:*:*:* Versions 2.3.7 Vulnerable ·Cyrus
Show 33 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:cyrus:imap:2.3.8:*:*:*:*:*:*:*2.3.8VulnerableCyrus
cpe:2.3:a:cyrus:imap:2.3.9:*:*:*:*:*:*:*2.3.9VulnerableCyrus
cpe:2.3:a:cyrus:imap:2.3.10:*:*:*:*:*:*:*2.3.10VulnerableCyrus
cpe:2.3:a:cyrus:imap:2.3.11:*:*:*:*:*:*:*2.3.11VulnerableCyrus
cpe:2.3:a:cyrus:imap:2.3.12:*:*:*:*:*:*:*2.3.12VulnerableCyrus
cpe:2.3:a:cyrus:imap:2.3.13:*:*:*:*:*:*:*2.3.13VulnerableCyrus
cpe:2.3:a:cyrus:imap:2.3.14:*:*:*:*:*:*:*2.3.14VulnerableCyrus
cpe:2.3:a:cyrus:imap:2.3.15:*:*:*:*:*:*:*2.3.15VulnerableCyrus
cpe:2.3:a:cyrus:imap:2.3.16:*:*:*:*:*:*:*2.3.16VulnerableCyrus
cpe:2.3:a:cyrus:imap:2.3.17:*:*:*:*:*:*:*2.3.17VulnerableCyrus
cpe:2.3:a:cyrus:imap:2.3.18:*:*:*:*:*:*:*2.3.18VulnerableCyrus
cpe:2.3:a:cyrus:imap:2.4.0:*:*:*:*:*:*:*2.4.0VulnerableCyrus
cpe:2.3:a:cyrus:imap:2.4.1:*:*:*:*:*:*:*2.4.1VulnerableCyrus
cpe:2.3:a:cyrus:imap:2.4.2:*:*:*:*:*:*:*2.4.2VulnerableCyrus
cpe:2.3:a:cyrus:imap:2.4.3:*:*:*:*:*:*:*2.4.3VulnerableCyrus
cpe:2.3:a:cyrus:imap:2.4.4:*:*:*:*:*:*:*2.4.4VulnerableCyrus
cpe:2.3:a:cyrus:imap:2.4.5:*:*:*:*:*:*:*2.4.5VulnerableCyrus
cpe:2.3:a:cyrus:imap:2.4.6:*:*:*:*:*:*:*2.4.6VulnerableCyrus
cpe:2.3:a:cyrus:imap:2.4.7:*:*:*:*:*:*:*2.4.7VulnerableCyrus
cpe:2.3:a:cyrus:imap:2.4.8:*:*:*:*:*:*:*2.4.8VulnerableCyrus
cpe:2.3:a:cyrus:imap:2.4.9:*:*:*:*:*:*:*2.4.9VulnerableCyrus
cpe:2.3:a:cyrus:imap:2.4.10:*:*:*:*:*:*:*2.4.10VulnerableCyrus
cpe:2.3:a:cyrus:imap:2.4.11:*:*:*:*:*:*:*2.4.11VulnerableCyrus
cpe:2.3:a:cyrus:imap:2.4.12:*:*:*:*:*:*:*2.4.12VulnerableCyrus
cpe:2.3:a:cyrus:imap:2.4.13:*:*:*:*:*:*:*2.4.13VulnerableCyrus
cpe:2.3:a:cyrus:imap:2.4.14:*:*:*:*:*:*:*2.4.14VulnerableCyrus
cpe:2.3:a:cyrus:imap:2.4.15:*:*:*:*:*:*:*2.4.15VulnerableCyrus
cpe:2.3:a:cyrus:imap:2.4.16:*:*:*:*:*:*:*2.4.16VulnerableCyrus
cpe:2.3:a:cyrus:imap:2.4.17:*:*:*:*:*:*:*2.4.17VulnerableCyrus
cpe:2.3:a:cyrus:imap:2.5.0:*:*:*:*:*:*:*2.5.0VulnerableCyrus
cpe:2.3:a:cyrus:imap:2.5.1:*:*:*:*:*:*:*2.5.1VulnerableCyrus
cpe:2.3:a:cyrus:imap:2.5.2:*:*:*:*:*:*:*2.5.2VulnerableCyrus
cpe:2.3:a:cyrus:imap:2.5.3:*:*:*:*:*:*:*2.5.3VulnerableCyrus
  • cpe:2.3:a:cyrus:imap:2.3.8:*:*:*:*:*:*:* Versions 2.3.8 Vulnerable ·Cyrus
  • cpe:2.3:a:cyrus:imap:2.3.9:*:*:*:*:*:*:* Versions 2.3.9 Vulnerable ·Cyrus
  • cpe:2.3:a:cyrus:imap:2.3.10:*:*:*:*:*:*:* Versions 2.3.10 Vulnerable ·Cyrus
  • cpe:2.3:a:cyrus:imap:2.3.11:*:*:*:*:*:*:* Versions 2.3.11 Vulnerable ·Cyrus
  • cpe:2.3:a:cyrus:imap:2.3.12:*:*:*:*:*:*:* Versions 2.3.12 Vulnerable ·Cyrus
  • cpe:2.3:a:cyrus:imap:2.3.13:*:*:*:*:*:*:* Versions 2.3.13 Vulnerable ·Cyrus
  • cpe:2.3:a:cyrus:imap:2.3.14:*:*:*:*:*:*:* Versions 2.3.14 Vulnerable ·Cyrus
  • cpe:2.3:a:cyrus:imap:2.3.15:*:*:*:*:*:*:* Versions 2.3.15 Vulnerable ·Cyrus
  • cpe:2.3:a:cyrus:imap:2.3.16:*:*:*:*:*:*:* Versions 2.3.16 Vulnerable ·Cyrus
  • cpe:2.3:a:cyrus:imap:2.3.17:*:*:*:*:*:*:* Versions 2.3.17 Vulnerable ·Cyrus
  • cpe:2.3:a:cyrus:imap:2.3.18:*:*:*:*:*:*:* Versions 2.3.18 Vulnerable ·Cyrus
  • cpe:2.3:a:cyrus:imap:2.4.0:*:*:*:*:*:*:* Versions 2.4.0 Vulnerable ·Cyrus
  • cpe:2.3:a:cyrus:imap:2.4.1:*:*:*:*:*:*:* Versions 2.4.1 Vulnerable ·Cyrus
  • cpe:2.3:a:cyrus:imap:2.4.2:*:*:*:*:*:*:* Versions 2.4.2 Vulnerable ·Cyrus
  • cpe:2.3:a:cyrus:imap:2.4.3:*:*:*:*:*:*:* Versions 2.4.3 Vulnerable ·Cyrus
  • cpe:2.3:a:cyrus:imap:2.4.4:*:*:*:*:*:*:* Versions 2.4.4 Vulnerable ·Cyrus
  • cpe:2.3:a:cyrus:imap:2.4.5:*:*:*:*:*:*:* Versions 2.4.5 Vulnerable ·Cyrus
  • cpe:2.3:a:cyrus:imap:2.4.6:*:*:*:*:*:*:* Versions 2.4.6 Vulnerable ·Cyrus
  • cpe:2.3:a:cyrus:imap:2.4.7:*:*:*:*:*:*:* Versions 2.4.7 Vulnerable ·Cyrus
  • cpe:2.3:a:cyrus:imap:2.4.8:*:*:*:*:*:*:* Versions 2.4.8 Vulnerable ·Cyrus
  • cpe:2.3:a:cyrus:imap:2.4.9:*:*:*:*:*:*:* Versions 2.4.9 Vulnerable ·Cyrus
  • cpe:2.3:a:cyrus:imap:2.4.10:*:*:*:*:*:*:* Versions 2.4.10 Vulnerable ·Cyrus
  • cpe:2.3:a:cyrus:imap:2.4.11:*:*:*:*:*:*:* Versions 2.4.11 Vulnerable ·Cyrus
  • cpe:2.3:a:cyrus:imap:2.4.12:*:*:*:*:*:*:* Versions 2.4.12 Vulnerable ·Cyrus
  • cpe:2.3:a:cyrus:imap:2.4.13:*:*:*:*:*:*:* Versions 2.4.13 Vulnerable ·Cyrus
  • cpe:2.3:a:cyrus:imap:2.4.14:*:*:*:*:*:*:* Versions 2.4.14 Vulnerable ·Cyrus
  • cpe:2.3:a:cyrus:imap:2.4.15:*:*:*:*:*:*:* Versions 2.4.15 Vulnerable ·Cyrus
  • cpe:2.3:a:cyrus:imap:2.4.16:*:*:*:*:*:*:* Versions 2.4.16 Vulnerable ·Cyrus
  • cpe:2.3:a:cyrus:imap:2.4.17:*:*:*:*:*:*:* Versions 2.4.17 Vulnerable ·Cyrus
  • cpe:2.3:a:cyrus:imap:2.5.0:*:*:*:*:*:*:* Versions 2.5.0 Vulnerable ·Cyrus
  • cpe:2.3:a:cyrus:imap:2.5.1:*:*:*:*:*:*:* Versions 2.5.1 Vulnerable ·Cyrus
  • cpe:2.3:a:cyrus:imap:2.5.2:*:*:*:*:*:*:* Versions 2.5.2 Vulnerable ·Cyrus
  • cpe:2.3:a:cyrus:imap:2.5.3:*:*:*:*:*:*:* Versions 2.5.3 Vulnerable ·Cyrus

Remediation

No fixed version listed by the sources yet.

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 5AffectedNo fix planned: Will not fix
Red Hat Enterprise Linux 6AffectedNo fix planned: Will not fix
Red Hat Enterprise Linux 7AffectedNo fix planned: Will not fix

Timeline

  1. 2026-10-02 Threatist record created from CVE-2015-8076
  2. 2026-10-03 Alias added: GHSA-fxwg-gpw8-9wrp

References

Advisory 7

Other 5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences