Description
Off-by-one buffer overflow in Dovecot 1.0test53 through 1.0.rc14, and possibly other versions, when index files are used and mmap_disable is set to "yes," allows remote authenticated IMAP or POP3 users to cause a denial of service (crash) via unspecified vectors involving the cache file.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | dovecot | 1.0.rc15-1 | — |
| Debian 13 | dovecot | 1.0.rc15-1 | — |
| Debian 12 | dovecot | 1.0.rc15-1 | — |
References
- [Dovecot-news] 20091119 1.0.rc15 released mailing-list
- USN-387-1 vendor-advisory
- 23150 third-party-advisory
- SUSE-SA:2006:073 vendor-advisory
- 23007 third-party-advisory
- 23172 third-party-advisory
- dovecot-indexcache-bo(30433) vdb-entry
- 20061119 Dovecot IMAP/POP3 server: Off-by-one buffer overflow mailing-list
- [Dovecot-news] 20061119 Security hole #2: Off-by-one buffer overflow with mmap_disable=yes mailing-list
- 23213 third-party-advisory
- 1017288 vdb-entry
- ADV-2006-4614 vdb-entry
- 21183 vdb-entry
- https://issues.rpath.com/browse/RPL-802