CVE-2009-0688
Multiple buffer overflows in the CMU Cyrus SASL library before 2.1.23 might allow remote...
Multiple buffer overflows in the CMU Cyrus SASL library before 2.1.23 might allow remote attackers to execute arbitrary code or cause a denial of service (application crash) via strings that are used as input to the sasl_encode64 function in lib/saslutil.c.
Exploit likelihood
What each source reports
NVD Score used
Multiple buffer overflows in the CMU Cyrus SASL library before 2.1.23 might allow remote attackers to execute arbitrary code or cause a denial of service (application crash) via strings that are used as input to the sasl_encode64 function in lib/saslutil.c.
- Record
CVE-2009-0688- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-119
- Updated
- 2026-11-02
CVE List No score
Multiple buffer overflows in the CMU Cyrus SASL library before 2.1.23 might allow remote attackers to execute arbitrary code or cause a denial of service (application crash) via strings that are used as input to the sasl_encode64 function in lib/saslutil.c.
- Record
CVE-2009-0688- Updated
- 2026-11-02
EUVDEUVD-2009-0688 No score
Multiple buffer overflows in the CMU Cyrus SASL library before 2.1.23 might allow remote attackers to execute arbitrary code or cause a denial of service (application crash) via strings that are used as input to the sasl_encode64 function in lib/saslutil.c.
- Record
EUVD-2009-0688- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-pjpw-9mvc-5cwc No score
Multiple buffer overflows in the CMU Cyrus SASL library before 2.1.23 might allow remote...
Multiple buffer overflows in the CMU Cyrus SASL library before 2.1.23 might allow remote attackers to execute arbitrary code or cause a denial of service (application crash) via strings that are used as input to the sasl_encode64 function in lib/saslutil.c.
- Record
GHSA-pjpw-9mvc-5cwc- Weakness
- CWE-119
- Updated
- 2026-11-02
OSV No score
Multiple buffer overflows in the CMU Cyrus SASL library before 2.1.23 might allow remote attackers to execute arbitrary code or cause a denial of service (application crash) via strings that are used as input to the sasl_encode64 function in lib/saslutil.c.
- Record
CVE-2009-0688- Updated
- 2026-11-02
OSVDEBIAN-CVE-2009-0688 No score
Multiple buffer overflows in the CMU Cyrus SASL library before 2.1.23 might allow remote attackers to execute arbitrary code or cause a denial of service (application crash) via strings that are used as input to the sasl_encode64 function in lib/saslutil.c.
- Record
DEBIAN-CVE-2009-0688- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10403-1 No score
cyrus-sasl-2.1.26-12.5 on GA media
These are all security issues fixed in the cyrus-sasl-2.1.26-12.5 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10403-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
cyrus-sasl2Debian:12 |
before 2.1.23.dfsg1-1 | 2.1.23.dfsg1-1 |
cyrus-sasl2Debian:13 |
before 2.1.23.dfsg1-1 | 2.1.23.dfsg1-1 |
cyrus-sasl2Debian:14 |
before 2.1.23.dfsg1-1 | 2.1.23.dfsg1-1 |
cyrus-sasl2-heimdalDebian:5.0 |
before 2.1.22.dfsg1-23+lenny1, plus listed versions 2.1.22.dfsg1-23 |
2.1.22.dfsg1-23+lenny1 |
cyrus-sasl2Debian:5.0 |
before 2.1.22.dfsg1-23+lenny1, plus listed versions 2.1.22.dfsg1-23 |
2.1.22.dfsg1-23+lenny1 |
cyrus-sasl2Debian:4.0 |
before 2.1.22.dfsg1-8+etch1, plus listed versions 2.1.22.dfsg1-8 |
2.1.22.dfsg1-8+etch1 |
cyrus-sasl2Debian:6.0 |
before 2.1.22.dfsg1-23+squeeze1 | 2.1.22.dfsg1-23+squeeze1 |
cyrus-sasl2-heimdalDebian:6.0 |
before 2.1.22.dfsg1-23+squeeze1, plus listed versions 2.1.22.dfsg1-102.1.22.dfsg1-112.1.22.dfsg1-122.1.22.dfsg1-132.1.22.dfsg1-14 Show 11 moreShow less2.1.22.dfsg1-152.1.22.dfsg1-162.1.22.dfsg1-172.1.22.dfsg1-182.1.22.dfsg1-192.1.22.dfsg1-202.1.22.dfsg1-212.1.22.dfsg1-222.1.22.dfsg1-232.1.22.dfsg1-23+lenny12.1.22.dfsg1-9 |
2.1.22.dfsg1-23+squeeze1 |
cyrus-imapdRed Hat:enterprise_linux:4::as |
before 0:2.2.12-10.el4_8.1 | 0:2.2.12-10.el4_8.1 |
cyrus-imapd-debuginfoRed Hat:enterprise_linux:4::as |
before 0:2.2.12-10.el4_8.1 | 0:2.2.12-10.el4_8.1 |
Show 36 moreShow less
| Package | Affected | Fixed |
|---|---|---|
cyrus-imapd-develRed Hat:enterprise_linux:4::as |
before 0:2.2.12-10.el4_8.1 | 0:2.2.12-10.el4_8.1 |
cyrus-imapd-murderRed Hat:enterprise_linux:4::as |
before 0:2.2.12-10.el4_8.1 | 0:2.2.12-10.el4_8.1 |
cyrus-imapd-nntpRed Hat:enterprise_linux:4::as |
before 0:2.2.12-10.el4_8.1 | 0:2.2.12-10.el4_8.1 |
cyrus-imapd-utilsRed Hat:enterprise_linux:4::as |
before 0:2.2.12-10.el4_8.1 | 0:2.2.12-10.el4_8.1 |
perl-CyrusRed Hat:enterprise_linux:4::as |
before 0:2.2.12-10.el4_8.1 | 0:2.2.12-10.el4_8.1 |
cyrus-imapdRed Hat:enterprise_linux:4::desktop |
before 0:2.2.12-10.el4_8.1 | 0:2.2.12-10.el4_8.1 |
cyrus-imapd-debuginfoRed Hat:enterprise_linux:4::desktop |
before 0:2.2.12-10.el4_8.1 | 0:2.2.12-10.el4_8.1 |
cyrus-imapd-develRed Hat:enterprise_linux:4::desktop |
before 0:2.2.12-10.el4_8.1 | 0:2.2.12-10.el4_8.1 |
cyrus-imapd-murderRed Hat:enterprise_linux:4::desktop |
before 0:2.2.12-10.el4_8.1 | 0:2.2.12-10.el4_8.1 |
cyrus-imapd-nntpRed Hat:enterprise_linux:4::desktop |
before 0:2.2.12-10.el4_8.1 | 0:2.2.12-10.el4_8.1 |
cyrus-imapd-utilsRed Hat:enterprise_linux:4::desktop |
before 0:2.2.12-10.el4_8.1 | 0:2.2.12-10.el4_8.1 |
perl-CyrusRed Hat:enterprise_linux:4::desktop |
before 0:2.2.12-10.el4_8.1 | 0:2.2.12-10.el4_8.1 |
cyrus-imapdRed Hat:enterprise_linux:4::es |
before 0:2.2.12-10.el4_8.1 | 0:2.2.12-10.el4_8.1 |
cyrus-imapd-debuginfoRed Hat:enterprise_linux:4::es |
before 0:2.2.12-10.el4_8.1 | 0:2.2.12-10.el4_8.1 |
cyrus-imapd-develRed Hat:enterprise_linux:4::es |
before 0:2.2.12-10.el4_8.1 | 0:2.2.12-10.el4_8.1 |
cyrus-imapd-murderRed Hat:enterprise_linux:4::es |
before 0:2.2.12-10.el4_8.1 | 0:2.2.12-10.el4_8.1 |
cyrus-imapd-nntpRed Hat:enterprise_linux:4::es |
before 0:2.2.12-10.el4_8.1 | 0:2.2.12-10.el4_8.1 |
cyrus-imapd-utilsRed Hat:enterprise_linux:4::es |
before 0:2.2.12-10.el4_8.1 | 0:2.2.12-10.el4_8.1 |
perl-CyrusRed Hat:enterprise_linux:4::es |
before 0:2.2.12-10.el4_8.1 | 0:2.2.12-10.el4_8.1 |
cyrus-imapdRed Hat:enterprise_linux:4::ws |
before 0:2.2.12-10.el4_8.1 | 0:2.2.12-10.el4_8.1 |
cyrus-imapd-debuginfoRed Hat:enterprise_linux:4::ws |
before 0:2.2.12-10.el4_8.1 | 0:2.2.12-10.el4_8.1 |
cyrus-imapd-develRed Hat:enterprise_linux:4::ws |
before 0:2.2.12-10.el4_8.1 | 0:2.2.12-10.el4_8.1 |
cyrus-imapd-murderRed Hat:enterprise_linux:4::ws |
before 0:2.2.12-10.el4_8.1 | 0:2.2.12-10.el4_8.1 |
cyrus-imapd-nntpRed Hat:enterprise_linux:4::ws |
before 0:2.2.12-10.el4_8.1 | 0:2.2.12-10.el4_8.1 |
cyrus-imapd-utilsRed Hat:enterprise_linux:4::ws |
before 0:2.2.12-10.el4_8.1 | 0:2.2.12-10.el4_8.1 |
perl-CyrusRed Hat:enterprise_linux:4::ws |
before 0:2.2.12-10.el4_8.1 | 0:2.2.12-10.el4_8.1 |
cyrus-imapdRed Hat:enterprise_linux:5::client_workstation |
before 0:2.3.7-2.el5_3.2 | 0:2.3.7-2.el5_3.2 |
cyrus-imapd-debuginfoRed Hat:enterprise_linux:5::client_workstation |
before 0:2.3.7-2.el5_3.2 | 0:2.3.7-2.el5_3.2 |
cyrus-imapd-develRed Hat:enterprise_linux:5::client_workstation |
before 0:2.3.7-2.el5_3.2 | 0:2.3.7-2.el5_3.2 |
cyrus-imapd-perlRed Hat:enterprise_linux:5::client_workstation |
before 0:2.3.7-2.el5_3.2 | 0:2.3.7-2.el5_3.2 |
cyrus-imapd-utilsRed Hat:enterprise_linux:5::client_workstation |
before 0:2.3.7-2.el5_3.2 | 0:2.3.7-2.el5_3.2 |
cyrus-imapdRed Hat:enterprise_linux:5::server |
before 0:2.3.7-2.el5_3.2 | 0:2.3.7-2.el5_3.2 |
cyrus-imapd-debuginfoRed Hat:enterprise_linux:5::server |
before 0:2.3.7-2.el5_3.2 | 0:2.3.7-2.el5_3.2 |
cyrus-imapd-develRed Hat:enterprise_linux:5::server |
before 0:2.3.7-2.el5_3.2 | 0:2.3.7-2.el5_3.2 |
cyrus-imapd-perlRed Hat:enterprise_linux:5::server |
before 0:2.3.7-2.el5_3.2 | 0:2.3.7-2.el5_3.2 |
cyrus-imapd-utilsRed Hat:enterprise_linux:5::server |
before 0:2.3.7-2.el5_3.2 | 0:2.3.7-2.el5_3.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2009-0688 is a high vulnerability (CVSS 7.5) in Carnegie Mellon University Cyrus-sasl, published May 15, 2009. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 8.21%, the 94th percentile. Fixed in cyrus-sasl2 2.1.23.dfsg1-1.
References
osvdb.org/54515
secunia.com/advisories/35239
us-cert.gov/cas/techalerts/TA10-103B.html
kb.cert.org/vuls/id/238019
Show 43 moreShow less
slackware.com/security/viewer.php?l=slackware-security&y=2009&m=slackware-security.448834
sunsolve.sun.com/search/document.do?assetkey=1-77-1020755.1-1
lists.apple.com/archives/security-announce/2010//Mar/msg00001.html
debian.org/security/2009/dsa-1807
wiki.rpath.com/wiki/Advisories:rPSA-2009-0091
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6136
vupen.com/english/advisories/2009/1313
lists.opensuse.org/opensuse-security-announce/2009-06/msg00003.html
security.gentoo.org/glsa/glsa-200907-09.xml
support.apple.com/kb/HT4077
oracle.com/technetwork/topics/security/cpuapr2010-099504.html
support.avaya.com/elmodocs2/security/ASA-2009-184.htm
mandriva.com/security/advisories?name=MDVSA-2009:113
redhat.com/support/errata/RHSA-2009-1116.html
securityfocus.com/bid/34961
ubuntu.com/usn/usn-790-1
securitytracker.com/id?1022231
exchange.xforce.ibmcloud.com/vulnerabilities/50554
nvd.nist.gov/vuln/detail/CVE-2009-0688
github.com/advisories/GHSA-pjpw-9mvc-5cwc
security-tracker.debian.org/tracker/CVE-2009-0688
access.redhat.com/errata/RHSA-2009:1116
bugzilla.redhat.com/show_bug.cgi?id=504207
security.access.redhat.com/data/csaf/v2/advisories/2009/rhsa-2009_1116.json
cve.org/CVERecord?id=CVE-2009-0688
suse.com/security/cve/CVE-2009-0688