CVE-2007-5466
Multiple buffer overflows in eXtremail 2.1.1 and earlier allow remote attackers to (1) have an...
Multiple buffer overflows in eXtremail 2.1.1 and earlier allow remote attackers to (1) have an unknown impact by sending multiple long strings to the IMAP port (143/tcp); (2) execute arbitrary code via a long string in an IMAP AUTHENTICATE PLAIN action, involving the ifParseAuthPlain function; (3) execute arbitrary code via a long LOGIN command to the admin interface port (4501/tcp); or (4) execute arbitrary code via a long string in an IMAP AUTHENTICATE LOGIN (aka CRAM-MD5 authentication) action, involving the ifProcImapAuth1 function.
Exploit likelihood
What each source reports
NVD Score used
Multiple buffer overflows in eXtremail 2.1.1 and earlier allow remote attackers to (1) have an unknown impact by sending multiple long strings to the IMAP port (143/tcp); (2) execute arbitrary code via a long string in an IMAP AUTHENTICATE PLAIN action, involving the ifParseAuthPlain function; (3) execute arbitrary code via a long LOGIN command to the admin interface port (4501/tcp); or (4) execute arbitrary code via a long string in an IMAP AUTHENTICATE LOGIN (aka CRAM-MD5 authentication) action, involving the ifProcImapAuth1 function.
- Record
CVE-2007-5466- CVSS 2.0
- 10.0 High
AV:N/AC:L/Au:N/C:C/I:C/A:C - Weakness
- CWE-119
- Updated
- 2026-11-02
CVE List No score
Multiple buffer overflows in eXtremail 2.1.1 and earlier allow remote attackers to (1) have an unknown impact by sending multiple long strings to the IMAP port (143/tcp); (2) execute arbitrary code via a long string in an IMAP AUTHENTICATE PLAIN action, involving the ifParseAuthPlain function; (3) execute arbitrary code via a long LOGIN command to the admin interface port (4501/tcp); or (4) execute arbitrary code via a long string in an IMAP AUTHENTICATE LOGIN (aka CRAM-MD5 authentication) action, involving the ifProcImapAuth1 function.
- Record
CVE-2007-5466- Updated
- 2026-11-02
EUVDEUVD-2007-5441 No score
Multiple buffer overflows in eXtremail 2.1.1 and earlier allow remote attackers to (1) have an unknown impact by sending multiple long strings to the IMAP port (143/tcp); (2) execute arbitrary code via a long string in an IMAP AUTHENTICATE PLAIN action, involving the ifParseAuthPlain function; (3) execute arbitrary code via a long LOGIN command to the admin interface port (4501/tcp); or (4) execute arbitrary code via a long string in an IMAP AUTHENTICATE LOGIN (aka CRAM-MD5 authentication) action, involving the ifProcImapAuth1 function.
- Record
EUVD-2007-5441- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-92p2-532r-cg7m No score
Multiple buffer overflows in eXtremail 2.1.1 and earlier allow remote attackers to (1) have an...
Multiple buffer overflows in eXtremail 2.1.1 and earlier allow remote attackers to (1) have an unknown impact by sending multiple long strings to the IMAP port (143/tcp); (2) execute arbitrary code via a long string in an IMAP AUTHENTICATE PLAIN action, involving the ifParseAuthPlain function; (3) execute arbitrary code via a long LOGIN command to the admin interface port (4501/tcp); or (4) execute arbitrary code via a long string in an IMAP AUTHENTICATE LOGIN (aka CRAM-MD5 authentication) action, involving the ifProcImapAuth1 function.
- Record
GHSA-92p2-532r-cg7m- Weakness
- CWE-119
- Updated
- 2026-11-02
Affected products
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | eXtremail 2.1.1 - 'LOGIN' Remote Stack Overflow | 2007-10-15 |
| Exploit-DB | eXtremail 2.1.1 - PLAIN Authentication Remote Stack Overflow | 2007-10-15 |
| Exploit-DB | eXtremail 2.1.1 - Remote Heap Overflow (PoC) | 2007-10-15 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| aliases, exploits, facts, references, title | Exploit-DB, GitHub Advisories | |
| first indexed | CVE List, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2007-5466 is a high vulnerability (CVSS 10.0) in Extremail, published October 15, 2007. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 19.9%, the 97th percentile. No source names a fixed version.
References
digit-labs.org/files/exploits/extremail-v4.c
exploit-db.com/exploits/4533
secunia.com/advisories/27220
securityfocus.com/bid/26074