CVE-2021-3657

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A flaw was found in mbsync versions prior to 1.4.4. Due to inadequate handling of extremely large (>=2GiB) IMAP literals, malicious or compromised IMAP servers, and hypothetically even external email senders, could cause several different buffer overflows, which could conceivably be exploited for remote code execution.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-119

Affected software

Vendor	Product	Versions
n/a	isync	isync 1.4.4

References

https://bugzilla.redhat.com/show_bug.cgi?id=2028932Issue Tracking, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2022/07/msg00001.htmlMailing List, Third Party Advisory
https://security.gentoo.org/glsa/202208-15Third Party Advisory
https://www.openwall.com/lists/oss-security/2021/12/03/1Mailing List, Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2028932Issue Tracking, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2022/07/msg00001.htmlMailing List, Third Party Advisory
https://security.gentoo.org/glsa/202208-15Third Party Advisory
https://www.openwall.com/lists/oss-security/2021/12/03/1Mailing List, Third Party Advisory

Timeline

Published: Feb 18, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-365708.8Cross Site Request Forgery vulnerability in FUEL-CMS 1.4.13 allows remote attackers to run arbitrary code via post ID to /permissions/delete CVE-2021-365726.1Cross Site Scripting (XSS) vulnerability in Feehi CMS thru 2.1.1 allows attackers to run arbitrary code via the user name field of the login CVE-2021-365735.4File Upload vulnerability in Feehi CMS thru 2.1.1 allows attackers to run arbitrary code via crafted image upload.CVE-2021-36586.5bluetoothd from bluez incorrectly saves adapters' Discoverable status when a device is powered down, and restores it when powered up. If a d CVE-2021-365806.1Open Redirect vulnerability exists in IceWarp MailServer IceWarp Server Deep Castle 2 Update 1 (13.0.1.2) via the referer parameter.CVE-2021-365819.8Kooboo CMS 2.1.1.0 is vulnerable to Insecure file upload. It is possible to upload any file extension to the server. The server does not ver CVE-2021-365829.8In Kooboo CMS 2.1.1.0, it is possible to upload a remote shell (e.g., aspx) to the server and then call upon it to receive a reverse shell f CVE-2021-365845.5An issue was discovered in GPAC 1.0.1. There is a heap-based buffer overflow in the function gp_rtp_builder_do_tx3g function in ietf/rtp_pck CVE-2021-36595.5A NULL pointer dereference flaw was found in the Linux kernel’s IEEE 802.15.4 wireless networking subsystem in the way the user closes the L CVE-2021-36604.3Cockpit (and its plugins) do not seem to protect itself against clickjacking. It is possible to render a page from a cockpit server via anot CVE-2021-366016.1GetSimpleCMS 3.3.16 contains a cross-site Scripting (XSS) vulnerability, where Function TSL does not filter check settings.php Website URL: CVE-2021-366036.1Cross Site Scripting (XSS) in Tasmota firmware 6.5.0 allows remote attackers to inject JavaScript code via a crafted string in the field "Fr