Summary
[1:2.2.36-3.1]
- fix CVE-2019-11500: IMAP protocol parser does not properly handle NUL byte
when scanning data in quoted strings, leading to out of bounds heap
memory writes (#1751383)
Fixed packages 5
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 7 | dovecot | 1:2.2.36-3.el7_7.1 |
| Oracle Linux · 7 | dovecot-devel | 1:2.2.36-3.el7_7.1 |
| Oracle Linux · 7 | dovecot-mysql | 1:2.2.36-3.el7_7.1 |
| Oracle Linux · 7 | dovecot-pgsql | 1:2.2.36-3.el7_7.1 |
| Oracle Linux · 7 | dovecot-pigeonhole | 1:2.2.36-3.el7_7.1 |
Vulnerabilities 1
-
Unscored —CVE-2019-11500 EPSS 62%
In Dovecot before 2.2.36.4 and 2.3.x before 2.3.7.2 (and Pigeonhole before 0.5.7.2), protocol processing can fail for q…