Denial Of Service (DoS)

dovecot is vulnerable to denial of service DoS. The vulnerability exists as a specially formatted NTLM request will crash the auth service because of an out-of-bounds read...

Denial Of Service (DoS)

dovecot is vulnerable to denial of service DoS. The vulnerability exists through an uncontrolled recursion in submission, lmtp, and lda via a crafted e-mail message with deeply nested MIME parts...

Debian DLA-2328-1 : dovecot security update

Several vulnerabilities have been discovered in the Dovecot email server. CVE-2020-12100 Receiving mail with deeply nested MIME parts leads to resource exhaustion as Dovecot attempts to parse it. CVE-2020-12673 Dovecot's NTLM implementation does not correctly check message buffer size, which lead...

USN-4456-2 dovecot vulnerabilities

USN-4456-1 fixed several vulnerabilities in Dovecot. This update provides the corresponding update for Ubuntu 14.04 ESM. Original advisory details: It was discovered that Dovecot incorrectly handled deeply nested MIME parts. A remote attacker could possibly use this issue to cause Dovecot to...

USN-4456-2: Dovecot vulnerabilities

USN-4456-1 fixed several vulnerabilities in Dovecot. This update provides the corresponding update for Ubuntu 14.04 ESM. Original advisory details: It was discovered that Dovecot incorrectly handled deeply nested MIME parts. A remote attacker could possibly use this issue to cause Dovecot to...

Dovecot Denial of Service Vulnerability (CNVD-2020-46787)

Dovecot is an open source based on Linux/UNIX-like systems IMAP and POP3 mail server . A security vulnerability exists in Dovecot versions prior to 2.3.11.3 that stems from the program failing to properly handle the length of zeros. An attacker can exploit this vulnerability to cause the...

Dovecot Denial of Service Vulnerability (CNVD-2020-46785)

Dovecot is an open source based on Linux/UNIX-like systems IMAP and POP3 mail server . A security vulnerability exists in Dovecot versions prior to 2.3.11.3. A remote attacker can exploit this vulnerability to cause a denial of service resource consumption via a specially crafted e-mail message...

Dovecot Out-of-Bounds Read Vulnerability

Dovecot is an open source based on Linux/UNIX-like systems IMAP and POP3 mail server . A security vulnerability exists in Dovecot versions prior to 2.3.11.3. An attacker can exploit this vulnerability to cause the authentication service to crash...

mail/dovecot -- multiple vulnerabilities

Aki Tuomi reports: When imap hibernation is active, an attacker can cause Dovecot to discover file system directory structure and access other users' emails using specially crafted command. The attacker must have valid credentials to access the mail server. Mail delivery / parsing crashed when th...

Debian: Security Advisory (DLA-2328-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

PT-2020-6941 · Dovecot +7 · Dovecot +7

Name of the Vulnerable Software and Affected Versions: Dovecot versions prior to 2.3.13 Description: The issue is related to the improper neutralization of control and meta characters in the Dovecot mail server, allowing a remote attacker to access and compromise confidential data. By using IMAP...

[SECURITY] [DLA 2328-1] dovecot security update

Debian LTS Advisory DLA-2328-1 [email protected] https://www.debian.org/lts/security/ August 15, 2020 https://wiki.debian.org/LTS Package : dovecot Version : 1:2.2.27-3+deb9u6 CVE ID : CVE-2020-12100 CVE-2020-12673 CVE-2020-12674 Debian Bug : 968302 Several vulnerabilities have been...

DLA-2328-1 dovecot - security update

Bulletin has no description...

FreeBSD : mail/dovecot -- multiple vulnerabilities (87a07de1-e55e-4d51-bb64-8d117829a26a)

Aki Tuomi reports : Parsing mails with a large number of MIME parts could have resulted in excessive CPU usage or a crash due to running out of stack memory.. Dovecot's NTLM implementation does not correctly check message buffer size, which leads to reading past allocation which can lead to crash...

CVE-2020-12674

A flaw was found in dovecot. An attacker can use the way dovecot handles RPA Remote Passphrase Authentication to crash the authentication process repeatedly preventing login. The highest threat from this vulnerability is to system availability. Mitigation Upstream suggests that this flaw can be...

CVE-2020-12100

A flaw was found in dovecot. A remote attacker could cause a denial of service by repeatedly sending emails containing MIME parts containing malicious content of which dovecot will attempt to parse. The highest threat from this vulnerability is to system availability. Mitigation Upstream suggests...

CVE-2020-12673

A flaw was found in dovecot. An out-of-bounds read flaw was found in the way dovecot handled NTLM authentication allowing an attacker to crash the dovecot auth process repeatedly preventing login. The highest threat from this vulnerability is to system availability. Mitigation Upstream suggests...

Vulnerabilities fixed in Dovecot

Vulnerabilities have been fixed in Dovecot. The vulnerabilities allow a malicious person to cause a denial-of-service cause. Dovecot has released updates to fix the vulnerabilities. For more information, see the following pages: CVE-2020-12100:...

Debian DSA-4745-1 : dovecot - security update

Several vulnerabilities have been discovered in the Dovecot email server. - CVE-2020-12100 Receiving mail with deeply nested MIME parts leads to resource exhaustion as Dovecot attempts to parse it. - CVE-2020-12673 Dovecot's NTLM implementation does not correctly check message buffer size, which...

Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS : Dovecot vulnerabilities (USN-4456-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4456-1 advisory. It was discovered that Dovecot incorrectly handled deeply nested MIME parts. A remote attacker could possibly use this issue to...