Summary
[1:2.2.36-6]
- fix CVE-2019-11500: IMAP protocol parser does not properly handle NUL byte
when scanning data in quoted strings, leading to out of bounds heap
memory writes (#1741787)
[1:2.2.36-5]
- fix CVE-2019-3814: improper certificate validation (#1674369)
- fix CVE-2019-7524: buffer overflow in indexer-worker process resulting in privilege
escalation (#1700398)
[1:2.2.36-4]
- use portreserve to avoid port conflicts(#1270283)
Fixed packages 5
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 7 | dovecot | 1:2.2.36-6.el7 |
| Oracle Linux · 7 | dovecot-devel | 1:2.2.36-6.el7 |
| Oracle Linux · 7 | dovecot-mysql | 1:2.2.36-6.el7 |
| Oracle Linux · 7 | dovecot-pgsql | 1:2.2.36-6.el7 |
| Oracle Linux · 7 | dovecot-pigeonhole | 1:2.2.36-6.el7 |
Vulnerabilities 2
-
High 8.8
In Dovecot before 2.2.36.3 and 2.3.x before 2.3.5.1, a local attacker can cause a buffer overflow in the indexer-worker…
-
High 7.7
It was discovered that Dovecot before versions 2.2.36.1 and 2.3.4.1 incorrectly handled client certificates. A remote a…