60 results · Feed
-
Unscored —
An issue was discovered in Dovecot before 2.3.13. By using IMAP IDLE, an authenticated attacker can trigger unhibernati…
-
Unscored —
Dovecot before 2.3.13 has Improper Input Validation in lda, lmtp, and imap, leading to an application crash via a craft…
-
Unscored —
In Dovecot before 2.3.11.3, sending a specially formatted RPA request will crash the auth service because a length of z…
-
Unscored —
In Dovecot before 2.3.11.3, sending a specially formatted NTLM request will crash the auth service because of an out-of…
-
Unscored —
In Dovecot before 2.3.11.3, uncontrolled recursion in submission, lmtp, and lda allows remote attackers to cause a deni…
-
Medium 5.3
In Dovecot before 2.3.10.1, remote unauthenticated attackers can crash the lmtp or submission process by sending mail w…
-
Medium 5.3
In Dovecot before 2.3.10.1, a crafted SMTP/LMTP message triggers an unauthenticated use-after-free bug in submission-lo…
-
High 7.5
In Dovecot before 2.3.10.1, unauthenticated sending of malformed parameters to a NOOP command causes a NULL Pointer Der…
-
Low 3.1
The IMAP and LMTP components in Dovecot 2.3.9 before 2.3.9.3 mishandle snippet generation when many characters must be …
-
High 7.5CVE-2020-7046 EPSS 51%
lib-smtp in submission-login and lmtp in Dovecot 2.3.9 before 2.3.9.3 mishandles truncated UTF-8 data in command parame…
-
Unscored —
In Dovecot before 2.3.9.2, an attacker can crash a push-notification driver with a crafted email when push notification…
-
Unscored —CVE-2019-11500 EPSS 62%
In Dovecot before 2.2.36.4 and 2.3.x before 2.3.7.2 (and Pigeonhole before 0.5.7.2), protocol processing can fail for q…
-
High 7.5
In the IMAP Server in Dovecot 2.3.3 through 2.3.5.2, the submission-login service crashes when the client disconnects p…
-
Unscored —
In the IMAP Server in Dovecot 2.3.3 through 2.3.5.2, the submission-login component crashes if AUTH PLAIN is attempted …
-
Unscored —
The JSON encoder in Dovecot before 2.3.5.2 allows attackers to repeatedly crash the authentication service by attemptin…
-
High 8.8
In Dovecot before 2.2.36.3 and 2.3.x before 2.3.5.1, a local attacker can cause a buffer overflow in the indexer-worker…
-
High 7.7
It was discovered that Dovecot before versions 2.2.36.1 and 2.3.4.1 incorrectly handled client certificates. A remote a…
-
Unscored —
A denial of service flaw was found in dovecot before 2.2.34. An attacker able to generate random SNI server names could…
-
Medium 5.9CVE-2017-14461 EPSS 17%
A specially crafted email delivered over SMTP and passed on to Dovecot by MTA can trigger an out of bounds read resulti…
-
Unscored —
A flaw was found in dovecot 2.0 up to 2.2.33 and 2.3.0. An abort of SASL authentication results in a memory leak in dov…