GoogleOSV:CVE-2019-11500CVE-2019-11500
In Dovecot before 2.2.36.4 and 2.3.x before 2.3.7.2 (and Pigeonhole before 0.5.7.2), protocol processing can fail for quoted strings. This occurs because ‘\0’ characters are mishandled, and can lead to out-of-bounds writes and remote code execution.
References
lists.opensuse.org/opensuse-security-announce/2019-10/msg00024.html
lists.opensuse.org/opensuse-security-announce/2019-10/msg00026.html
www.openwall.com/lists/oss-security/2019/08/28/3
access.redhat.com/errata/RHSA-2019:2822
access.redhat.com/errata/RHSA-2019:2836
access.redhat.com/errata/RHSA-2019:2885
dovecot.org/pipermail/dovecot-news/2019-August/000417.html
lists.debian.org/debian-lts-announce/2019/08/msg00035.html
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3GYTZLLDNIFWT7D7JSB25ERJNMOR4CQ3/
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KVHY3MU2OK2EWZJFGNDSAOMD42L7DFPX/
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YSJVVVRAE3SITC2ZLGCPMFDN3WVYZBWF/
security.gentoo.org/glsa/201908-29
www.dovecot.org/security.html
Related
