CVE-2011-1720
NoneCVSS
—
EPSS
21.5%
Published
May 13, 2011
CISA due date
—
The record
The SMTP server in Postfix before 2.5.13, 2.6.x before 2.6.10, 2.7.x before 2.7.4, and 2.8.x before 2.8.3, when certain Cyrus SASL authentication methods are enabled, does not create a new server handle after client authentication fails, which allows remote attackers to cause a denial of service (heap memory corruption and daemon crash) or possibly execute arbitrary code via an invalid AUTH command with one method followed by an AUTH command with a different method.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Debian:11 | postfix | 0 | 2.8.3-1 |
| Debian:12 | postfix | 0 | 2.8.3-1 |
| Debian:13 | postfix | 0 | 2.8.3-1 |
| Debian:5.0 | postfix | 0 | 2.5.5-1.1+lenny1 |
| Debian:6.0 | postfix | 0 | 2.7.1-1+squeeze1 |
| Red Hat:enterprise_linux:4::as | postfix | 0 | 2:2.2.10-1.5.el4 |
| Red Hat:enterprise_linux:4::as | postfix-debuginfo | 0 | 2:2.2.10-1.5.el4 |
| Red Hat:enterprise_linux:4::as | postfix-pflogsumm | 0 | 2:2.2.10-1.5.el4 |
| Red Hat:enterprise_linux:4::desktop | postfix | 0 | 2:2.2.10-1.5.el4 |
| Red Hat:enterprise_linux:4::desktop | postfix-debuginfo | 0 | 2:2.2.10-1.5.el4 |
| Red Hat:enterprise_linux:4::desktop | postfix-pflogsumm | 0 | 2:2.2.10-1.5.el4 |
| Red Hat:enterprise_linux:4::es | postfix | 0 | 2:2.2.10-1.5.el4 |
| Red Hat:enterprise_linux:4::es | postfix-debuginfo | 0 | 2:2.2.10-1.5.el4 |
| Red Hat:enterprise_linux:4::es | postfix-pflogsumm | 0 | 2:2.2.10-1.5.el4 |
| Red Hat:enterprise_linux:4::ws | postfix | 0 | 2:2.2.10-1.5.el4 |
| Red Hat:enterprise_linux:4::ws | postfix-debuginfo | 0 | 2:2.2.10-1.5.el4 |
| Red Hat:enterprise_linux:4::ws | postfix-pflogsumm | 0 | 2:2.2.10-1.5.el4 |
| Red Hat:enterprise_linux:5::server | postfix | 0 | 2:2.3.3-2.3.el5_6 |
| Red Hat:enterprise_linux:5::server | postfix-debuginfo | 0 | 2:2.3.3-2.3.el5_6 |
| Red Hat:enterprise_linux:5::server | postfix-pflogsumm | 0 | 2:2.3.3-2.3.el5_6 |
| Red Hat:enterprise_linux:6::server | postfix | 0 | 2:2.6.6-2.2.el6_1 |
| Red Hat:enterprise_linux:6::server | postfix-debuginfo | 0 | 2:2.6.6-2.2.el6_1 |
| Red Hat:enterprise_linux:6::server | postfix-perl-scripts | 0 | 2:2.6.6-2.2.el6_1 |
Related vulnerabilities
- CVE-2023-51764 Postfix through 3.8.5 allows SMTP smuggling unless configured with… Also affects postfix
- CVE-2011-0411 The STARTTLS implementation in Postfix 2.4.x before 2.4.16, 2.5.x before 2.5.12, 2.6.x… Also affects postfix
- CVE-2003-0540 The address parser code in Postfix 1.1.12 and earlier allows remote attackers to cause a… Also affects postfix
- CVE-2026-112108 A vulnerability was determined in ztxz16 fastllm up to 0.1.8.2. CWE-119
- CVE-2026-112073 A vulnerability was identified in Tencent ncnn up to 44b02dabdcf97499281a4692ebd65bad73dc… CWE-119
- CVE-2026-90831 A vulnerability was detected in GNU Binutils 2.47. CWE-119
- CVE-2026-90804 A vulnerability was detected in GNU Binutils 2.47. CWE-119
- CVE-2026-90803 A security vulnerability has been detected in GNU Binutils 2.47. CWE-119