Multiple buffer overflows in Cyrus IMAPd before 2.2.11 may allow attackers to execute arbitrary code via (1) an off-by-one error in the imapd annotate extension (2) an off-by-one error in \cached header handling \ (3) a stack-based buffer overflow in fetchnews or (4) a stack-based buffer overflow in imapd.