CVE-2017-14461

2018-02-2800:00:00

CWE-125

talos

www.cve.org

CVSS3

5.9

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:H

AI Score

6.8

Confidence

High

EPSS

0.317

Percentile

97.0%

JSON

A specially crafted email delivered over SMTP and passed on to Dovecot by MTA can trigger an out of bounds read resulting in potential sensitive information disclosure and denial of service. In order to trigger this vulnerability, an attacker needs to send a specially crafted email message to the server.

CNA Affected

[
  {
    "product": "Dovecot",
    "vendor": "The Dovecot Project",
    "versions": [
      {
        "status": "affected",
        "version": "2.2.33.2"
      }
    ]
  }
]