Every CVE Search/ Get API key

CVE-2004-0884

The (1) libsasl and (2) libsasl2 libraries in Cyrus-SASL 2.1.18 and earlier trust the SASL_PATH...

7.2 HighFix available

The (1) libsasl and (2) libsasl2 libraries in Cyrus-SASL 2.1.18 and earlier trust the SASL_PATH environment variable to find all available SASL plug-ins, which allows local users to execute arbitrary code by modifying the SASL_PATH to point to malicious programs.

Exploit likelihood

0.50%Down 1.7 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 7.2

The (1) libsasl and (2) libsasl2 libraries in Cyrus-SASL 2.1.18 and earlier trust the SASL_PATH environment variable to find all available SASL plug-ins, which allows local users to execute arbitrary code by modifying the SASL_PATH to point to malicious programs.

Record
CVE-2004-0884
CVSS 2.0
7.2 HighAV:L/AC:L/Au:N/C:C/I:C/A:C
Updated
2026-11-02
CVE List No score

The (1) libsasl and (2) libsasl2 libraries in Cyrus-SASL 2.1.18 and earlier trust the SASL_PATH environment variable to find all available SASL plug-ins, which allows local users to execute arbitrary code by modifying the SASL_PATH to point to malicious programs.

Record
CVE-2004-0884
Updated
2026-11-02
EUVDEUVD-2004-0882 No score

The (1) libsasl and (2) libsasl2 libraries in Cyrus-SASL 2.1.18 and earlier trust the SASL_PATH environment variable to find all available SASL plug-ins, which allows local users to execute arbitrary code by modifying the SASL_PATH to point to malicious programs.

Record
EUVD-2004-0882
Updated
2026-11-03
GitHub AdvisoriesGHSA-pggp-j979-w3jj No score

The (1) libsasl and (2) libsasl2 libraries in Cyrus-SASL 2.1.18 and earlier trust the SASL_PATH...

The (1) libsasl and (2) libsasl2 libraries in Cyrus-SASL 2.1.18 and earlier trust the SASL_PATH environment variable to find all available SASL plug-ins, which allows local users to execute arbitrary code by modifying the SASL_PATH to point to malicious programs.

Record
GHSA-pggp-j979-w3jj
Updated
2026-11-02
OSV No score

The (1) libsasl and (2) libsasl2 libraries in Cyrus-SASL 2.1.18 and earlier trust the SASL_PATH environment variable to find all available SASL plug-ins, which allows local users to execute arbitrary code by modifying the SASL_PATH to point to malicious programs.

Record
CVE-2004-0884
Updated
2026-11-02
OSVDEBIAN-CVE-2004-0884 No score

The (1) libsasl and (2) libsasl2 libraries in Cyrus-SASL 2.1.18 and earlier trust the SASL_PATH environment variable to find all available SASL plug-ins, which allows local users to execute arbitrary code by modifying the SASL_PATH to point to malicious programs.

Record
DEBIAN-CVE-2004-0884
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
cyrus-sasl2
Debian:12
 before 2.1.19-1.3
2.1.19-1.3
cyrus-sasl2
Debian:13
 before 2.1.19-1.3
2.1.19-1.3
cyrus-sasl2
Debian:14
 before 2.1.19-1.3
2.1.19-1.3
cyrus-sasl
Debian:3.0
 before 1.5.27-3.1woody5
1.5.27-3.1woody5
cyrus-sasl-mit
Debian:3.0
 before 1.5.24-15woody3
1.5.24-15woody3
cyrus-sasl
Red Hat:enterprise_linux:3::as
 before 0:2.1.15-10
0:2.1.15-10
cyrus-sasl-debuginfo
Red Hat:enterprise_linux:3::as
 before 0:2.1.15-10
0:2.1.15-10
cyrus-sasl-devel
Red Hat:enterprise_linux:3::as
 before 0:2.1.15-10
0:2.1.15-10
cyrus-sasl-gssapi
Red Hat:enterprise_linux:3::as
 before 0:2.1.15-10
0:2.1.15-10
cyrus-sasl-md5
Red Hat:enterprise_linux:3::as
 before 0:2.1.15-10
0:2.1.15-10
Show 19 moreShow less
Affected packages
PackageAffectedFixed
cyrus-sasl-plain
Red Hat:enterprise_linux:3::as
 before 0:2.1.15-10
0:2.1.15-10
cyrus-sasl
Red Hat:enterprise_linux:3::desktop
 before 0:2.1.15-10
0:2.1.15-10
cyrus-sasl-debuginfo
Red Hat:enterprise_linux:3::desktop
 before 0:2.1.15-10
0:2.1.15-10
cyrus-sasl-devel
Red Hat:enterprise_linux:3::desktop
 before 0:2.1.15-10
0:2.1.15-10
cyrus-sasl-gssapi
Red Hat:enterprise_linux:3::desktop
 before 0:2.1.15-10
0:2.1.15-10
cyrus-sasl-md5
Red Hat:enterprise_linux:3::desktop
 before 0:2.1.15-10
0:2.1.15-10
cyrus-sasl-plain
Red Hat:enterprise_linux:3::desktop
 before 0:2.1.15-10
0:2.1.15-10
cyrus-sasl
Red Hat:enterprise_linux:3::es
 before 0:2.1.15-10
0:2.1.15-10
cyrus-sasl-debuginfo
Red Hat:enterprise_linux:3::es
 before 0:2.1.15-10
0:2.1.15-10
cyrus-sasl-devel
Red Hat:enterprise_linux:3::es
 before 0:2.1.15-10
0:2.1.15-10
cyrus-sasl-gssapi
Red Hat:enterprise_linux:3::es
 before 0:2.1.15-10
0:2.1.15-10
cyrus-sasl-md5
Red Hat:enterprise_linux:3::es
 before 0:2.1.15-10
0:2.1.15-10
cyrus-sasl-plain
Red Hat:enterprise_linux:3::es
 before 0:2.1.15-10
0:2.1.15-10
cyrus-sasl
Red Hat:enterprise_linux:3::ws
 before 0:2.1.15-10
0:2.1.15-10
cyrus-sasl-debuginfo
Red Hat:enterprise_linux:3::ws
 before 0:2.1.15-10
0:2.1.15-10
cyrus-sasl-devel
Red Hat:enterprise_linux:3::ws
 before 0:2.1.15-10
0:2.1.15-10
cyrus-sasl-gssapi
Red Hat:enterprise_linux:3::ws
 before 0:2.1.15-10
0:2.1.15-10
cyrus-sasl-md5
Red Hat:enterprise_linux:3::ws
 before 0:2.1.15-10
0:2.1.15-10
cyrus-sasl-plain
Red Hat:enterprise_linux:3::ws
 before 0:2.1.15-10
0:2.1.15-10

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2004-0884 is a high vulnerability (CVSS 7.2) in Cyrus Sasl, published October 12, 2004. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.50%, the 43rd percentile. Fixed in cyrus-sasl2 2.1.19-1.3.

References

Show 20 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open