CLSA-2026-1778220630 dovecot: Fix of 3 CVEs

CVE-2026-27855: fix OTP authentication replay attack via auth cache - CVE-2026-27856: fix doveadm credential timing oracle - CVE-2026-27857: fix excessive memory usage from deeply nested IMAP command lists pre-auth ID command...

Important: dovecot

Issue Overview: Doveadm credentials are verified using direct comparison which is susceptible to timing oracle attack. An attacker can use this to determine the configured credentials. Figuring out the credential will lead into full access to the affected component. Limit access to the doveadm ht...

DEBIAN-CVE-2019-11191

The Linux kernel through 5.0.7, when CONFIGIA32AOUT is enabled and ia32aout is loaded, allows local users to bypass ASLR on setuid a.out programs if any exist because installexeccreds is called too late in loadaoutbinary in fs/binfmtaout.c, and thus the ptracemayaccess check has a race condition...