Summary
It was discovered that Dovecot incorrectly handled parsing certain email
addresses. A remote attacker could use this issue to cause Dovecot to
crash, resulting in a denial of service, or possibly obtain sensitive
information. (CVE-2017-14461)
It was discovered that Dovecot incorrectly handled TLS SNI config lookups.
A remote attacker could possibly use this issue to cause Dovecot to crash,
resulting in a denial of service. (CVE-2017-15130)
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 14.04 LTS 14.04:LTS | dovecot | 1:2.2.9-1ubuntu2.4 |
| Ubuntu · 16.04 LTS 16.04:LTS | dovecot | 1:2.2.22-1ubuntu2.7 |
Vulnerabilities 2
-
Medium 5.9CVE-2017-14461 EPSS 17%
A specially crafted email delivered over SMTP and passed on to Dovecot by MTA can trigger an out of bounds read resulti…
-
Unscored —
A denial of service flaw was found in dovecot before 2.2.34. An attacker able to generate random SNI server names could…