mail/dovecot -- multiple vulnerabilities

Aki Tuomi reports:

Parsing mails with a large number of MIME parts could
have resulted in excessive CPU usage or a crash due to running out of
stack memory…

Dovecot’s NTLM implementation does not correctly check
message buffer size, which leads to reading past allocation which can
lead to crash

lmtp/submission: Issuing the RCPT command with an
address that has the empty quoted string as local-part causes the lmtp
service to crash.

Dovecot’s RPA mechanism implementation accepts
zero-length message, which leads to assert-crash later on.