2388 matches found
dovecot: malformed NOOP commands leads to DoS
A flaw was found in Dovecot, where it did not properly handle certain malformed NOOP commands. This flaw allows a malicious attacker to cause the submission, submission-login, or lmtp services to crash by sending specially crafted commands...
Important: Red Hat Security Advisory: dovecot security update
An update for dovecot is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from t...
dovecot:fuzz-smtp-server: Heap-buffer-overflow in smtp_command_parse_line
Project: https://github.com/dovecot/core.git Detailed Report: https://oss-fuzz.com/testcase?key=6020231943421952 Project: dovecot Fuzzing Engine: afl Fuzz Target: fuzz-smtp-server Job Type: aflasandovecot Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address: 0x625000007100 Cra...
dovecot:fuzz-smtp-server: Heap-buffer-overflow in uni_utf8_get_char_n
Project: https://github.com/dovecot/core.git Detailed Report: https://oss-fuzz.com/testcase?key=5271279639986176 Project: dovecot Fuzzing Engine: afl Fuzz Target: fuzz-smtp-server Job Type: aflasandovecot Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address: 0x625000009900 Cra...
Dovecot Null Pointer Dereference (CVE-2020-10957)
A Null pointer dereference vulnerability exists in Dovecot. Successful exploitation results in a denial of service condition on the affected service...
Dovecot Denial of Service (CVE-2020-10967)
A denial-of-service vulnerability exists in Dovecot. Successful exploitation of this vulnerability could cause a denial-of-service condition...
dovecot.2317879.n4.nabble.com Cross Site Scripting vulnerability
Open Bug Bounty ID: OBB-1184727 Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website...
Fedora 32 : 1:dovecot (2020-1dee17d880)
CVE-2020-10957: lmtp/submission: A client can crash the server by sending a NOOP command with an invalid string parameter. This occurs particularly for a parameter that doesn't start with a double quote. This applies to all SMTP services, including submission-login, which makes it possible to...
Fedora: Security Advisory for dovecot (FEDORA-2020-b60344c987)
The remote host is missing an update for the Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...
[SECURITY] Fedora 31 Update: dovecot-2.3.10.1-1.fc31
Dovecot is an IMAP server for Linux/UNIX-like systems, written with security primarily in mind. It also contains a small POP3 server. It supports mail in either of maildir or mbox formats. The SQL drivers and authentication plug-ins are in their subpackages...
Fedora 31 : 1:dovecot (2020-b60344c987)
CVE-2020-10957: lmtp/submission: A client can crash the server by sending a NOOP command with an invalid string parameter. This occurs particularly for a parameter that doesn't start with a double quote. This applies to all SMTP services, including submission-login, which makes it possible to...
Open-Xchange: Directory traversal allows execution of arbitrary binaries usign doveadm exec
Both the doveadm-exec man page and the online manual specify that it can be used to execute commands from Dovecot's libexecdir which sounds like an implicit security boundary. I recently ran across a situation where doveadm-exec was whitelisted in sudoers to be run as root. I realized it was...
Updated dovecot packages fix security vulnerabilities
Dovecot has been updated to fix several security issues. Sending malformed NOOP command causes crash in submission, submission-login or lmtp service CVE-2020-10957. Sending command followed by sufficient number of newlines triggers a use-after-free bug that might crash submission-login, submissio...
MGASA-2020-0222 Updated dovecot packages fix security vulnerabilities
Dovecot has been updated to fix several security issues. Sending malformed NOOP command causes crash in submission, submission-login or lmtp service CVE-2020-10957. Sending command followed by sufficient number of newlines triggers a use-after-free bug that might crash submission-login, submissio...
[SECURITY] Fedora 32 Update: dovecot-2.3.10.1-1.fc32
Dovecot is an IMAP server for Linux/UNIX-like systems, written with security primarily in mind. It also contains a small POP3 server. It supports mail in either of maildir or mbox formats. The SQL drivers and authentication plug-ins are in their subpackages...
Security fix for the ALT Linux 9 package dovecot version 2.3.10.1-alt1
2.3.10.1-alt1 built May 21, 2020 Gleb Fotengauer-Malinovskiy in task 252013 May 20, 2020 Gleb Fotengauer-Malinovskiy - Updated to 2.3.10.1 fixes CVE-2020-10957, CVE-2020-10958, CVE-2020-10967...
Debian: Security Advisory (DSA-4690-1)
The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Debian DSA-4690-1 : dovecot - security update
Several vulnerabilities were discovered in the Dovecot email server, which could cause crashes in the submission, submission-login or lmtp services, resulting in denial of service. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Debian...
[SECURITY] [DSA 4690-1] dovecot security update
------------------------------------------------------------------------- Debian Security Advisory DSA-4690-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso May 20, 2020 https://www.debian.org/security/faq -...
[SECURITY] [DSA 4690-1] dovecot security update
------------------------------------------------------------------------- Debian Security Advisory DSA-4690-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso May 20, 2020 https://www.debian.org/security/faq -...