2388 matches found
CVE-2019-10691
CVE-2019-10691 affects Dovecot, where the JSON encoder in versions prior to 2.3.5.2 can be triggered by an invalid UTF-8 sequence as the username, causing repeated crashes of the authentication service. Connected docs corroborate this with references to Dovecot versions and the vulnerability desc...
CVE-2019-10691
The JSON encoder in Dovecot before 2.3.5.2 allows attackers to repeatedly crash the authentication service by attempting to authenticate with an invalid UTF-8 sequence as the username...
CVE-2019-10691
The JSON encoder in Dovecot before 2.3.5.2 allows attackers to repeatedly crash the authentication service by attempting to authenticate with an invalid UTF-8 sequence as the username...
CVE-2019-10691
The JSON encoder in Dovecot before 2.3.5.2 allows attackers to repeatedly crash the authentication service by attempting to authenticate with an invalid UTF-8 sequence as the username...
Ubuntu 18.10 / 19.04 : Dovecot vulnerability (USN-3951-1)
It was discovered that the Dovecot JSON encoder incorrectly handled certain invalid UTF-8 characters. A remote attacker could possibly use this issue to cause Dovecot to repeatedly crash, resulting in a denial of service. Note that Tenable Network Security has extracted the preceding description...
Ubuntu: Security Advisory (USN-3951-1)
The remote host is missing an update for the SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
USN-3951-1: Dovecot vulnerability
It was discovered that the Dovecot JSON encoder incorrectly handled certain invalid UTF-8 characters. A remote attacker could possibly use this issue to cause Dovecot to repeatedly crash, resulting in a denial of service...
Open-Xchange: Two heap use-after-free errors in IMAP operations
Summary ======= We’ve found two heap use-after-free errors, one in lib-storage/index/index-storage.c: indexcopycachefields and one in lib-index/mail-index-sync-update.c: mailindexsyncrecordreal. Error 1: indexcopycachefields ---------------------------------------------- This error involves two...
FreeBSD : dovecot -- json encoder crash (a64aa22f-61ec-11e9-85b9-a4badb296695)
Aki Tuomi reports : CVE-2019-10691: Trying to login with 8bit username containing invalid UTF8 input causes auth process to crash if auth policy is enabled. This could be used rather easily to cause a DoS. Similar crash also happens during mail delivery when using invalid UTF8 in From or Subject...
CVE-2019-10691
The JSON encoder in Dovecot before 2.3.5.2 allows attackers to repeatedly crash the authentication service by attempting to authenticate with an invalid UTF-8 sequence as the username...
CVE-2019-10691
The JSON encoder in Dovecot before 2.3.5.2 allows attackers to repeatedly crash the authentication service by attempting to authenticate with an invalid UTF-8 sequence as the username...
UBUNTU-CVE-2019-10691
The JSON encoder in Dovecot before 2.3.5.2 allows attackers to repeatedly crash the authentication service by attempting to authenticate with an invalid UTF-8 sequence as the username...
GLSA-201904-19 : Dovecot: Multiple vulnerabilities
The remote host is affected by the vulnerability described in GLSA-201904-19 Dovecot: Multiple vulnerabilities Multiple vulnerabilities have been discovered in Dovecot. Please review the CVE identifiers referenced below for details. Impact : Please review the referenced CVE identifiers for detail...
[ASA-201904-9] dovecot: denial of service
Arch Linux Security Advisory ASA-201904-9 ========================================= Severity: Medium Date : 2019-04-18 CVE-ID : CVE-2019-10691 Package : dovecot Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-950 Summary ======= The package dovecot before version...
Dovecot: Multiple vulnerabilities
Background Dovecot is an open source IMAP and POP3 email server. Description Multiple vulnerabilities have been discovered in Dovecot. Please review the CVE identifiers referenced below for details. Impact Please review the referenced CVE identifiers for details Workaround There is no known...
The vulnerability of the Dovecot mail server, related to authentication errors, allows attackers to gain unauthorized access to protected information.
The vulnerability of the Dovecot mail server is related to authentication errors. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to protected information...
Open-Xchange: Memory corruption in imap-parser.c
Hello Dovecot devs, this is a report from Nick Roessler and Rafi Rubin. We are researchers at the University of Pennsylvania. We’ve been fuzzing Dovecot and have triggered some memory errors---this one is the most serious, and can be used for controlled indirect out-of-bounds writes into heap...
Dovecot -- improper input validation
Aki Tuomi reports: Vulnerability Details: IMAP and ManageSieve protocol parsers do not properly handle NUL byte when scanning data in quoted strings, leading to out of bounds heap memory writes. Risk: This vulnerability allows for out-of-bounds writes to objects stored on the heap up to 8096 byte...
MGASA-2019-0141 Updated dovecot packages fix security vulnerability
CVE-2019-7524: Missing input buffer size validation leads into arbitrary buffer overflow when reading fts or pop3 uidl header from Dovecot index. Exploiting this requires direct write access to the index files...
Updated dovecot packages fix security vulnerability
CVE-2019-7524: Missing input buffer size validation leads into arbitrary buffer overflow when reading fts or pop3 uidl header from Dovecot index. Exploiting this requires direct write access to the index files...