Cyrus SASL vulnerabilities

In Cyrus SASL versions 2.1.17 through 2.1.27 before 2.1.28, plugins/sql.c does not escape the password for SQL INSERT or UPDATE statements.

cyrus-sasl 2.1.27 has an out-of-bounds write leading to unauthenticated remote denial-of-service in OpenLDAP via a malformed LDAP packet. The OpenLDAP crash is caused by an off-by-one error in _sasl_add_string in common.c.

Heap-based buffer overflow in Cyrus SASL. The add_to_challenge() function in the DIGEST-MD5 plugin does not recompute buffer size after quoting, leading to out-of-bounds write. A malicious server can crash the client.

cyrus-sasl before version 1.5.24 in Red Hat Linux 7.0 does not properly verify the authorization for a local user, which could allow users to bypass specified access restrictions.