96 results · Feed
-
Medium 4.3
Dovecot has provided a script to use for attachment to text conversion. This script unsafely handles zip-style attachme…
-
High 7.4
When cache is enabled, some passdb/userdb drivers incorrectly cache all users with same cache key, causing wrong cached…
-
High 7.5
Very large headers can cause resource exhaustion when parsing message. The message-parser normally reads reasonably siz…
-
Medium 5.0
Having a large number of address headers (From, To, Cc, Bcc, etc.) becomes excessively CPU intensive. With 100k header …
-
High 8.8
An issue was discovered in the auth component in Dovecot 2.2 and 2.3 before 2.3.20. When two passdb configuration entri…
-
Medium 4.3
The Sieve engine in Dovecot before 2.3.15 allows Uncontrolled Resource Consumption, as demonstrated by a situation with…
-
Unscored —
The submission service in Dovecot before 2.3.15 allows STARTTLS command injection in lib-smtp. Sensitive information ca…
-
High 7.5
Dovecot before 2.3.15 allows ../ Path Traversal. An attacker with access to the local filesystem can trick OAuth2 authe…
-
Unscored —
An issue was discovered in Dovecot before 2.3.13. By using IMAP IDLE, an authenticated attacker can trigger unhibernati…
-
Unscored —
Dovecot before 2.3.13 has Improper Input Validation in lda, lmtp, and imap, leading to an application crash via a craft…
-
Unscored —
In Dovecot before 2.3.11.3, sending a specially formatted RPA request will crash the auth service because a length of z…
-
Unscored —
In Dovecot before 2.3.11.3, sending a specially formatted NTLM request will crash the auth service because of an out-of…
-
Unscored —
In Dovecot before 2.3.11.3, uncontrolled recursion in submission, lmtp, and lda allows remote attackers to cause a deni…
-
Medium 5.3
In Dovecot before 2.3.10.1, remote unauthenticated attackers can crash the lmtp or submission process by sending mail w…
-
Medium 5.3
In Dovecot before 2.3.10.1, a crafted SMTP/LMTP message triggers an unauthenticated use-after-free bug in submission-lo…
-
High 7.5
In Dovecot before 2.3.10.1, unauthenticated sending of malformed parameters to a NOOP command causes a NULL Pointer Der…
-
Unscored —CVE-2019-11500 EPSS 62%
In Dovecot before 2.2.36.4 and 2.3.x before 2.3.7.2 (and Pigeonhole before 0.5.7.2), protocol processing can fail for q…
-
High 7.5
In the IMAP Server in Dovecot 2.3.3 through 2.3.5.2, the submission-login service crashes when the client disconnects p…
-
Unscored —
In the IMAP Server in Dovecot 2.3.3 through 2.3.5.2, the submission-login component crashes if AUTH PLAIN is attempted …
-
Unscored —
The JSON encoder in Dovecot before 2.3.5.2 allows attackers to repeatedly crash the authentication service by attemptin…
-
High 8.8
In Dovecot before 2.2.36.3 and 2.3.x before 2.3.5.1, a local attacker can cause a buffer overflow in the indexer-worker…
-
High 7.7
It was discovered that Dovecot before versions 2.2.36.1 and 2.3.4.1 incorrectly handled client certificates. A remote a…
-
Low 3.7
Dovecot before version 2.2.29 is vulnerable to a denial of service. When 'dict' passdb and userdb were used for user au…
-
Unscored —
A denial of service flaw was found in dovecot before 2.2.34. An attacker able to generate random SNI server names could…
-
Medium 5.9CVE-2017-14461 EPSS 17%
A specially crafted email delivered over SMTP and passed on to Dovecot by MTA can trigger an out of bounds read resulti…
-
Unscored —
A flaw was found in dovecot 2.0 up to 2.2.33 and 2.3.0. An abort of SASL authentication results in a memory leak in dov…
-
Unscored —
The ssl-proxy-openssl.c function in Dovecot before 2.2.17, when SSLv3 is disabled, allow remote attackers to cause a de…
-
Unscored —CVE-2016-8652 EPSS 48%
The auth component in Dovecot before 2.2.27, when auth-policy is configured, allows a remote attackers to cause a denia…
-
Unscored —
Dovecot 1.1 before 2.2.13 and dovecot-ee before 2.1.7.7 and 2.2.x before 2.2.12.12 does not properly close old connecti…
-
Unscored —
checkpassword-reply in Dovecot before 2.2.7 performs setuid operations to a user who is authenticating, which allows lo…
-
Unscored —
Dovecot 2.0.x before 2.0.16, when ssl or starttls is enabled and hostname is used to define the proxy destination, does…
-
Unscored —
lib-mail/message-header-parser.c in Dovecot 1.2.x before 1.2.17 and 2.0.x before 2.0.13 does not properly handle '\0' c…
-
Unscored —
script-login in Dovecot 2.0.x before 2.0.13 does not follow the chroot configuration setting, which might allow remote …
-
Unscored —
script-login in Dovecot 2.0.x before 2.0.13 does not follow the user and group configuration settings, which might allo…
-
Unscored —
Dovecot 1.2.x before 1.2.15 allows remote authenticated users to cause a denial of service (master process outage) by s…
-
Unscored —
Dovecot 1.2.x before 1.2.15 and 2.0.x before 2.0.beta2 grants the admin permission to the owner of each mailbox in a no…
-
Unscored —
plugins/acl/acl-backend-vfile.c in Dovecot 1.2.x before 1.2.15 and 2.0.x before 2.0.5 interprets an ACL entry as a dire…
-
Unscored —
plugins/acl/acl-backend-vfile.c in Dovecot 1.2.x before 1.2.15 and 2.0.x before 2.0.5 interprets an ACL entry as a dire…
-
Unscored —
The ACL plugin in Dovecot 1.2.x before 1.2.13 propagates INBOX ACLs to newly created mailboxes in certain configuration…
-
Unscored —
Unspecified vulnerability in Dovecot 1.2.x before 1.2.11 allows remote attackers to cause a denial of service (CPU cons…