Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2008-5514


Off-by-one error in the rfc822_output_char function in the RFC822BUFFER routines in the University of Washington (UW) c-client library, as used by the UW IMAP toolkit before imap-2007e and other applications, allows context-dependent attackers to cause a denial of service (crash) via an e-mail message that triggers a buffer overflow.


Security Impact Summary

CVE-2008-5514 is a security vulnerability that . Impacting 1 product from university_of_washington organizations running these solutions should prioritize assessment and patching.

Historical Context

Originally identified in 2008, this vulnerability predates many modern security frameworks and practices. The vulnerability landscape of that era was characterized by different threat models and less mature defense mechanisms compared to contemporary standards.


Published

2008-12-23T18:30:03.280

Last Modified

2026-04-23T00:35:47.467

Status

Modified

Source

[email protected]

Severity

CVSSv2: 4.3 (MEDIUM)

CVSSv2 Vector

AV:N/AC:M/Au:N/C:N/I:N/A:P

  • Access Vector: NETWORK
  • Access Complexity: MEDIUM
  • Authentication: NONE
  • Confidentiality Impact: NONE
  • Integrity Impact: NONE
  • Availability Impact: PARTIAL
Exploitability Score

8.6

Impact Score

2.9

Weaknesses
  • Type: Primary
    CWE-119

Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application university_of_washington imap ≤ 2007d Yes
Application university_of_washington imap 2000 Yes
Application university_of_washington imap 2000a Yes
Application university_of_washington imap 2000b Yes
Application university_of_washington imap 2000c Yes
Application university_of_washington imap 2001 Yes
Application university_of_washington imap 2001a Yes
Application university_of_washington imap 2002 Yes
Application university_of_washington imap 2002a Yes
Application university_of_washington imap 2002b Yes
Application university_of_washington imap 2002c Yes
Application university_of_washington imap 2002d Yes
Application university_of_washington imap 2002e Yes
Application university_of_washington imap 2002f Yes
Application university_of_washington imap 2004 Yes
Application university_of_washington imap 2004a Yes
Application university_of_washington imap 2004b Yes
Application university_of_washington imap 2004c Yes
Application university_of_washington imap 2004d Yes
Application university_of_washington imap 2004e Yes
Application university_of_washington imap 2004f Yes
Application university_of_washington imap 2004g Yes
Application university_of_washington imap 2006 Yes
Application university_of_washington imap 2006a Yes
Application university_of_washington imap 2006b Yes
Application university_of_washington imap 2006c Yes
Application university_of_washington imap 2006d Yes
Application university_of_washington imap 2006e Yes
Application university_of_washington imap 2006f Yes
Application university_of_washington imap 2006g Yes
Application university_of_washington imap 2006h Yes
Application university_of_washington imap 2006i Yes
Application university_of_washington imap 2006j Yes
Application university_of_washington imap 2006k Yes
Application university_of_washington imap 2007 Yes
Application university_of_washington imap 2007a Yes
Application university_of_washington imap 2007b Yes

References

How SecUtils Interprets This CVE

SecUtils normalizes and enriches National Vulnerability Database (NVD) records by standardizing vendor and product identifiers, aggregating vulnerability metadata from both NVD and MITRE sources, and providing structured context for security teams. For university_of_washington's affected products, we extract Common Platform Enumeration (CPE) data, Common Weakness Enumeration (CWE) classifications, CVSS severity metrics, and reference data to enable rapid vulnerability prioritization and asset correlation. This record contains no exploit code, proof-of-concept instructions, or attack methodologies—only defensive intelligence necessary for patch management, risk assessment, and security operations.