CVE-2019-11500

2019-08-2914:15:00

Debian Security Bug Tracker

security-tracker.debian.org

0.614 Medium

EPSS

Percentile

97.8%

JSON

In Dovecot before 2.2.36.4 and 2.3.x before 2.3.7.2 (and Pigeonhole before 0.5.7.2), protocol processing can fail for quoted strings. This occurs because ‘\0’ characters are mishandled, and can lead to out-of-bounds writes and remote code execution.

OSVersionArchitecturePackageVersionFilename
Debian12alldovecot< 1:2.3.7.2-1dovecot_1:2.3.7.2-1_all.deb
Debian11alldovecot< 1:2.3.7.2-1dovecot_1:2.3.7.2-1_all.deb
Debian10alldovecot< 1:2.3.4.1-5+deb10u1dovecot_1:2.3.4.1-5+deb10u1_all.deb
Debian999alldovecot< 1:2.3.7.2-1dovecot_1:2.3.7.2-1_all.deb
Debian13alldovecot< 1:2.3.7.2-1dovecot_1:2.3.7.2-1_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	12	all	dovecot	< 1:2.3.7.2-1	dovecot_1:2.3.7.2-1_all.deb
Debian	11	all	dovecot	< 1:2.3.7.2-1	dovecot_1:2.3.7.2-1_all.deb
Debian	10	all	dovecot	< 1:2.3.4.1-5+deb10u1	dovecot_1:2.3.4.1-5+deb10u1_all.deb
Debian	999	all	dovecot	< 1:2.3.7.2-1	dovecot_1:2.3.7.2-1_all.deb
Debian	13	all	dovecot	< 1:2.3.7.2-1	dovecot_1:2.3.7.2-1_all.deb