62 results · Feed
-
Medium 4.3
Dovecot has provided a script to use for attachment to text conversion. This script unsafely handles zip-style attachme…
-
High 7.4
When cache is enabled, some passdb/userdb drivers incorrectly cache all users with same cache key, causing wrong cached…
-
High 7.5
Very large headers can cause resource exhaustion when parsing message. The message-parser normally reads reasonably siz…
-
Medium 5.0
Having a large number of address headers (From, To, Cc, Bcc, etc.) becomes excessively CPU intensive. With 100k header …
-
High 8.8
An issue was discovered in the auth component in Dovecot 2.2 and 2.3 before 2.3.20. When two passdb configuration entri…
-
Medium 4.3
The Sieve engine in Dovecot before 2.3.15 allows Uncontrolled Resource Consumption, as demonstrated by a situation with…
-
Unscored —
The submission service in Dovecot before 2.3.15 allows STARTTLS command injection in lib-smtp. Sensitive information ca…
-
Unscored —
An issue was discovered in Dovecot before 2.3.13. By using IMAP IDLE, an authenticated attacker can trigger unhibernati…
-
Unscored —
Dovecot before 2.3.13 has Improper Input Validation in lda, lmtp, and imap, leading to an application crash via a craft…
-
Unscored —
In Dovecot before 2.3.11.3, sending a specially formatted RPA request will crash the auth service because a length of z…
-
Unscored —
In Dovecot before 2.3.11.3, sending a specially formatted NTLM request will crash the auth service because of an out-of…
-
Unscored —
In Dovecot before 2.3.11.3, uncontrolled recursion in submission, lmtp, and lda allows remote attackers to cause a deni…
-
Medium 5.3
In Dovecot before 2.3.10.1, remote unauthenticated attackers can crash the lmtp or submission process by sending mail w…
-
Medium 5.3
In Dovecot before 2.3.10.1, a crafted SMTP/LMTP message triggers an unauthenticated use-after-free bug in submission-lo…
-
High 7.5
In Dovecot before 2.3.10.1, unauthenticated sending of malformed parameters to a NOOP command causes a NULL Pointer Der…
-
Unscored —CVE-2019-11500 EPSS 62%
In Dovecot before 2.2.36.4 and 2.3.x before 2.3.7.2 (and Pigeonhole before 0.5.7.2), protocol processing can fail for q…
-
High 8.8
In Dovecot before 2.2.36.3 and 2.3.x before 2.3.5.1, a local attacker can cause a buffer overflow in the indexer-worker…
-
High 7.7
It was discovered that Dovecot before versions 2.2.36.1 and 2.3.4.1 incorrectly handled client certificates. A remote a…
-
Unscored —
A denial of service flaw was found in dovecot before 2.2.34. An attacker able to generate random SNI server names could…
-
Medium 5.9CVE-2017-14461 EPSS 17%
A specially crafted email delivered over SMTP and passed on to Dovecot by MTA can trigger an out of bounds read resulti…
-
Unscored —
A flaw was found in dovecot 2.0 up to 2.2.33 and 2.3.0. An abort of SASL authentication results in a memory leak in dov…
-
Unscored —
Dovecot 1.1 before 2.2.13 and dovecot-ee before 2.1.7.7 and 2.2.x before 2.2.12.12 does not properly close old connecti…