PT-2014-7873

Name of the Vulnerable Software and Affected Versions getmail versions 4.0.0 through 4.43.0 Description The issue concerns the IMAP-over-SSL implementation, which fails to verify X.509 certificates from SSL servers. This allows man-in-the-middle attackers to spoof IMAP servers and obtain sensitiv...

CVE-2014-7274: Undefined Security Weakness

The IMAP-over-SSL implementation in getmail 4.44.0 does not verify that the server hostname matches a domain name in the subject's Common Name CN field of the X.509 certificate, which allows man-in-the-middle attackers to spoof IMAP servers and obtain sensitive information via a crafted certifica...

CVE-2014-7273: Undefined Security Weakness

The IMAP-over-SSL implementation in getmail 4.0.0 through 4.43.0 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof IMAP servers and obtain sensitive information via a crafted certificate...

[SECURITY] Fedora 21 Update: nginx-1.6.2-2.fc21

Nginx is a web server and a reverse proxy server for HTTP, SMTP, POP3 and IMAP protocols, with a strong focus on high concurrency, performance and low memory usage...

CVE-2014-4366

Mail in Apple iOS before 8 does not prevent sending a LOGIN command to a LOGINDISABLED IMAP server, which allows remote attackers to obtain sensitive cleartext information by sniffing the network...

CVE-2014-4366

Mail in Apple iOS before 8 does not prevent sending a LOGIN command to a LOGINDISABLED IMAP server, which allows remote attackers to obtain sensitive cleartext information by sniffing the network...

CVE-2014-4366

Vulnerability summary (CVE-2014-4366) : In iOS Mail prior to iOS 8, the Mail client could send the LOGIN command to IMAP servers that advertised LOGINDISABLED, enabling an attacker to sniff and obtain cleartext credentials on the network. Affected component : Mail app (iOS). Root cause : Mail did...

CVE-2014-4366: Undefined Security Weakness

Mail in Apple iOS before 8 does not prevent sending a LOGIN command to a LOGINDISABLED IMAP server, which allows remote attackers to obtain sensitive cleartext information by sniffing the network...

Debian Security Advisory DSA 3028-1 (icedove - security update)

Multiple security issues have been found in Icedove, Debian OpenVAS Vulnerability Test $Id: deb3028.nasl 6735 2017-07-17 09:56:49Z teissa $ Auto-generated from advisory DSA 3028-1 using nvtgen 1.0 Script version: 1.0 Author: Greenbone Networks Copyright: Copyright c 2014 Greenbone Networks GmbH...

[SECURITY] Fedora 19 Update: zarafa-7.1.10-4.fc19

The Zarafa Collaboration Platform is a Microsoft Exchange replacement. The Open Source Collaboration provides an integration with your existing Linux mail server, native mobile phone support by ActiveSync compatibility and a webaccess with 'Look & Feel' similar to Outlook using Ajax. Including an...

[SECURITY] Fedora 19 Update: zarafa-7.1.10-2.fc19

The Zarafa Collaboration Platform is a Microsoft Exchange replacement. The Open Source Collaboration provides an integration with your existing Linux mail server, native mobile phone support by ActiveSync compatibility and a webaccess with 'Look & Feel' similar to Outlook using Ajax. Including an...

DLA-0021-1 fail2ban - security update

Bulletin has no description...

Medium: dovecot

Issue Overview: Dovecot 1.1 before 2.2.13 and dovecot-ee before 2.1.7.7 and 2.2.x before 2.2.12.12 does not properly close old connections, which allows remote attackers to cause a denial of service resource consumption via an incomplete SSL/TLS handshake for an IMAP/POP3 connection. Affected...

Debian DSA-2979-1 : fail2ban - security update

Two vulnerabilities were discovered in Fail2ban, a solution to ban hosts that cause multiple authentication errors. When using Fail2ban to monitor Postfix or Cyrus IMAP logs, improper input validation in log parsing could enable a remote attacker to trigger an IP ban on arbitrary addresses,...

[SECURITY] [DSA 2979-1] fail2ban security update

------------------------------------------------------------------------- Debian Security Advisory DSA-2979-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff July 17, 2014 http://www.debian.org/security/faq -...

DSA-2979-1 fail2ban - security update

Bulletin has no description...

Medium: php54

Issue Overview: acinclude.m4, as used in the configure script in PHP 5.5.13 and earlier, allows local users to overwrite arbitrary files via a symlink attack on the /tmp/phpglibccheck file. A denial of service flaw was found in the way the File Information fileinfo extension parsed certain...

Magic Winmail Server 4.0 (Build 1112) download.php Traversal Arbitrary File Access

No description provided by source. source: http://www.securityfocus.com/bid/12388/info Magic Winmail Server is reportedly affected by multiple vulnerabilities. There are two distinct directory traversal vulnerabilities in the Webmail interface allowing both arbitrary file downloads and uploads...

PHP 4.x/5.0/5.1 with Sendmail Mail Function additional_parameters - Argument Arbitrary File Creation

No description provided by source. source: http://www.securityfocus.com/bid/16878/info PHP is prone to multiple input-validation vulnerabilities that could allow 'safemode' and 'openbasedir' security settings to be bypassed. These issues reside in the 'mbsendmail' function, the 'mail' function, a...

hMailServer 4.4.1 IMAP Command Remote Denial of Service Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/30663/info hMailServer is prone to a remote denial-of-service vulnerability caused by large numbers of certain IMAP commands. Exploiting this issue will cause the server to crash and deny access to legitimate users...