description: A flaw was found in mbsync before v1.3.6 and v1.4.2, where an unchecked pointer cast allows a malicious or compromised server to write an arbitrary integer value past the end of a heap-allocated structure by issuing an unexpected APPENDUID response. This could be plausibly exploited for remote code execution on the client.
problem types: CWE-704
affected:
{
product: isync
vendor: n/a
versions:
status: affected, version: isync 1.3.6, isync 1.4.2
}