153 matches found
SUSE CVE-2010-0745
Unspecified vulnerability in Dovecot 1.2.x before 1.2.11 allows remote attackers to cause a denial of service CPU consumption via long headers in an e-mail message...
SUSE CVE-2013-6171
checkpassword-reply in Dovecot before 2.2.7 performs setuid operations to a user who is authenticating, which allows local users to bypass authentication and access virtual email accounts by attaching to the process and using a restricted file descriptor to modify account information in the...
SUSE CVE-2015-3420
The ssl-proxy-openssl.c function in Dovecot before 2.2.17, when SSLv3 is disabled, allow remote attackers to cause a denial of service login process crash via vectors related to handshake failures...
SUSE CVE-2020-10967
In Dovecot before 2.3.10.1, remote unauthenticated attackers can crash the lmtp or submission process by sending mail with an empty localpart...
Oracle Linux 9 : dovecot (ELSA-2022-8208)
The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2022-8208 advisory. 1:2.3.16-7.0.1 - do not run systemd commands during leapp upgrade Orabug: 34680501 1:2.3.16-7 - fix possible privilege escalation when similar master and...
USN-5509-1: Dovecot vulnerability
Julian Brook discovered that Dovecot incorrectly handled multiple passdb configuration entries. In certain configurations, a remote attacker could possibly use this issue to escalate privileges...
The submission service in Dovecot before 2.3.15 allows STARTTLS command injection in lib-smtp. Sensitive information can be redirected to an attacker-controlled address.
...
AZL-7196 CVE-2021-33515 affecting package dovecot for versions less than 2.3.20-1
The submission service in Dovecot before 2.3.15 allows STARTTLS command injection in lib-smtp. Sensitive information can be redirected to an attacker-controlled address...
AZL-7195 CVE-2021-29157 affecting package dovecot for versions less than 2.3.20-1
Dovecot before 2.3.15 allows ../ Path Traversal. An attacker with access to the local filesystem can trick OAuth2 authentication into using an HS256 validation key from an attacker-controlled location. This occurs during use of local JWT validation with the posix fs driver...
Email Bug Allows Message Snooping, Credential Theft
Researchers warn hackers can snoop on email messages by exploiting a bug in the underlying technology used by the majority of email servers that run the Internet Message Access Protocol, commonly referred to as IMAP. The bug, first reported in August 2020 and patched Monday, is tied to the email...
UBUNTU-CVE-2020-28200
The Sieve engine in Dovecot before 2.3.15 allows Uncontrolled Resource Consumption, as demonstrated by a situation with a complex regular expression for the regex extension...
Dovecot 资源管理错误漏洞
Dovecot is an open source IMAP and POP3 mail server for Linux/UNIX-like systems. Dovecot suffers from a resource management error vulnerability that stems from improper management of internal resources in the Regular Expression Filtering extension. A remote attacker could pass specially crafted...
Dovecot Denial of Service Vulnerability (CNVD-2021-01531)
Dovecot is an open source IMAP and POP3 mail server for Linux/Unix. A denial of service vulnerability exists in Dovecot versions prior to 2.3.13. The vulnerability stems from improper input validation issues with lda, lmtp, and imap. An attacker could exploit the vulnerability via a specially...
DEBIAN-CVE-2020-24386
An issue was discovered in Dovecot before 2.3.13. By using IMAP IDLE, an authenticated attacker can trigger unhibernation via attacker-controlled parameters, leading to access to other users' email messages and path disclosure...
UBUNTU-CVE-2020-24386
An issue was discovered in Dovecot before 2.3.13. By using IMAP IDLE, an authenticated attacker can trigger unhibernation via attacker-controlled parameters, leading to access to other users' email messages and path disclosure...
Dovecot Security Breach
Dovecot is an open source IMAP and POP3 mail server based on Linux/UNIX-like systems. A security vulnerability exists in Dovecot before 2.3.13, which can be exploited by an attacker to access another user's email messages by triggering the deactivation of hibernation with a parameter controlled b...
The vulnerability of the Dovecot mail server, related to incorrect validation of input data, allows attackers to cause failures in the authentication service.
The vulnerability of the Dovecot mail server is related to incorrect validation of input data. Exploiting this vulnerability can allow a remote attacker to cause failures in the authentication service by sending a specially formatted RPA request...
dovecot: command followed by sufficient number of newlines leads to use-after-free
In Dovecot before 2.3.10.1, a crafted SMTP/LMTP message triggers an unauthenticated use-after-free bug in submission-login, submission, or lmtp, and can lead to a crash under circumstances involving many newlines after a command...
dovecot: sending mail with empty quoted localpart leads to DoS
In Dovecot before 2.3.10.1, remote unauthenticated attackers can crash the lmtp or submission process by sending mail with an empty localpart...
