CVE catalog

CVE-2008-5005

alpine: CVE-2008-5005

Severity: Low
Published: Nov 5, 2008, 12:00:00 AM UTC
Source: [NVD] · [CVE record]
EPSS: 6.35% · Oct 25, 2026

Multiple stack-based buffer overflows in (1) University of Washington IMAP Toolkit 2002 through 2007c, (2) University of Washington Alpine 2.00 and earlier, and (3) Panda IMAP allow (a) local users to gain privileges by specifying a long folder extension argument on the command line to the tmail or dmail program; and (b) remote attackers to execute arbitrary code by sending e-mail to a destination mailbox name composed of a username and '+' character followed by a long string, processed by the tmail or possibly dmail program.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	alpine	sid	`2.26+dfsg-6`	not affected
Debian	alpine	forky	`2.26+dfsg-6`	not affected
Debian	alpine	trixie	`2.26+dfsg-3`	not affected
Debian	alpine	bookworm	`2.26+dfsg-1`	not affected
Debian	uw-imap	bookworm	`8:2007f~dfsg-7`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	alpine	source	sid	`Not affected`	unimportant	Not reported	Not reported
Debian	alpine	source	forky	`Not affected`	unimportant	Not reported	Not reported
Debian	alpine	source	trixie	`Not affected`	unimportant	Not reported	Not reported
Debian	alpine	source	bookworm	`Not affected`	unimportant	Not reported	Not reported
Debian	uw-imap	source	bookworm	`7:2007d~dfsg-1`	not yet assigned	Not reported	Not reported

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[alpine]Not affected
Details (2)
- 2.26+dfsg-1 · amd64 · bookworm
  Not affected
  dsa · alpine · debian · bookworm
- 2.26+dfsg-1 · arm64 · bookworm
  Not affected
  dsa · alpine · debian · bookworm
[alpine-doc]Not affected
Source package: [alpine]
Details (2)
- 2.26+dfsg-1 · all · bookworm
  Not affected
  dsa · alpine · debian · bookworm
- 2.26+dfsg-1 · all · bookworm
  Not affected
  dsa · alpine · debian · bookworm
[alpine-pico]Not affected
Source package: [alpine]
Details (2)
- 2.26+dfsg-1 · amd64 · bookworm
  Not affected
  dsa · alpine · debian · bookworm
- 2.26+dfsg-1 · arm64 · bookworm
  Not affected
  dsa · alpine · debian · bookworm
[libc-client2007e]Fixed
Source package: [uw-imap]
Details (2)
- 8:2007f~dfsg-7+b1 · arm64 · bookworm
  Fixed · Fixed: 7:2007d~dfsg-1
  dsa · uw-imap · debian · bookworm; dsa · uw-imap · debian · 12
- 8:2007f~dfsg-7+b2 · amd64 · bookworm
  Fixed · Fixed: 7:2007d~dfsg-1
  dsa · uw-imap · debian · bookworm; dsa · uw-imap · debian · 12
[libc-client2007e-dev]Fixed
Source package: [uw-imap]
Details (2)
- 8:2007f~dfsg-7+b1 · arm64 · bookworm
  Fixed · Fixed: 7:2007d~dfsg-1
  dsa · uw-imap · debian · bookworm; dsa · uw-imap · debian · 12
- 8:2007f~dfsg-7+b2 · amd64 · bookworm
  Fixed · Fixed: 7:2007d~dfsg-1
  dsa · uw-imap · debian · bookworm; dsa · uw-imap · debian · 12
[mlock]Fixed
Source package: [uw-imap]
Details (2)
- 8:2007f~dfsg-7+b1 · arm64 · bookworm
  Fixed · Fixed: 7:2007d~dfsg-1
  dsa · uw-imap · debian · bookworm; dsa · uw-imap · debian · 12
- 8:2007f~dfsg-7+b2 · amd64 · bookworm
  Fixed · Fixed: 7:2007d~dfsg-1
  dsa · uw-imap · debian · bookworm; dsa · uw-imap · debian · 12
[pilot]Not affected
Source package: [alpine]
Details (2)
- 2.26+dfsg-1 · amd64 · bookworm
  Not affected
  dsa · alpine · debian · bookworm
- 2.26+dfsg-1 · arm64 · bookworm
  Not affected
  dsa · alpine · debian · bookworm
[uw-mailutils]Fixed
Source package: [uw-imap]
Details (2)
- 8:2007f~dfsg-7+b1 · arm64 · bookworm
  Fixed · Fixed: 7:2007d~dfsg-1
  dsa · uw-imap · debian · bookworm; dsa · uw-imap · debian · 12
- 8:2007f~dfsg-7+b2 · amd64 · bookworm
  Fixed · Fixed: 7:2007d~dfsg-1
  dsa · uw-imap · debian · bookworm; dsa · uw-imap · debian · 12

Observed: Oct 23, 2026, 5:04:22 PM UTC

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]