CVE-2011-4318

Dovecot 2.0.x before 2.0.16, when ssl or starttls is enabled and hostname is used to define the proxy destination, does not verify that the server hostname matches a domain name in the subject's Common Name CN of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers...

CVE-2011-4318

Dovecot 2.0.x before 2.0.16 is vulnerable when ssl or starttls is enabled and hostname is used to define the proxy destination: it does not verify that the server hostname matches a domain name in the certificate’s CN, enabling MITM spoofing with a valid certificate. Affected version family: Dove...

CVE-2011-4318

Dovecot 2.0.x before 2.0.16, when ssl or starttls is enabled and hostname is used to define the proxy destination, does not verify that the server hostname matches a domain name in the subject's Common Name CN of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers...

CVE-2011-4318: Improper Input Validation

Dovecot 2.0.x before 2.0.16, when ssl or starttls is enabled and hostname is used to define the proxy destination, does not verify that the server hostname matches a domain name in the subject's Common Name CN of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers...

Scientific Linux Security Update : dovecot on SL6.x i386/x86_64 (20130221)

Two flaws were found in the way some settings were enforced by the script-login functionality of Dovecot. A remote, authenticated user could use these flaws to bypass intended access restrictions or conduct a directory traversal attack by leveraging login scripts. CVE-2011-2166, CVE-2011-2167 A...

Scientific Linux Security Update : selinux-policy enhancement update on SL6.x i386/x86_64 (20130221)

This update adds the following enhancements : - With the Multi-Level Security MLS SELinux policy enabled, a user created with an SELinux MLS level could not login to the system through an |SSH| client. The SELinux policy rules have been updated to allow the user to log in to the system in the...

dovecot security update

CentOS Errata and Security Advisory CESA-2013:0520 Updated dovecot packages that fix three security issues and one bug are now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having low security impact. Common Vulnerability Scoring System CVSS...

dovecot security and bug fix update

1:2.0.9-5 - script-login did not drop privileges correctly 709095 - fix directory traversal due to not obeying chroot directive 709097 - check proxy destination host against SSL certificate name 754980 1:2.0.9-4 - dovecot may not set correct premissions for mail folder 697620 1:2.0.9-3 - fix...

RedHat Update for dovecot RHSA-2013:0520-02

Check for the Version of dovecot OpenVAS Vulnerability Test RedHat Update for dovecot RHSA-2013:0520-02 Authors: System Generated Check Copyright: Copyright c 2013 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the...

RedHat Update for dovecot RHSA-2013:0520-02

The remote host is missing an update for the SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptxrefname:"URL",...

RHEL 6 : dovecot (RHSA-2013:0520)

Updated dovecot packages that fix three security issues and one bug are now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having low security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed severity ratings,...

dovecot: authenticated remote bypass of intended access restrictions

script-login in Dovecot 2.0.x before 2.0.13 does not follow the user and group configuration settings, which might allow remote authenticated users to bypass intended access restrictions by leveraging a script...

dovecot: directory traversal due to not obeying chroot directive

script-login in Dovecot 2.0.x before 2.0.13 does not follow the chroot configuration setting, which might allow remote authenticated users to conduct directory traversal attacks by leveraging a script...

dovecot: proxy destination host name not checked against SSL certificate name

Dovecot 2.0.x before 2.0.16, when ssl or starttls is enabled and hostname is used to define the proxy destination, does not verify that the server hostname matches a domain name in the subject's Common Name CN of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers...

PT-2013-1428

Name of the Vulnerable Software and Affected Versions Dovecot versions 2.0.x through 2.0.15 Description The issue arises when ssl or starttls is enabled and the hostname is used to define the proxy destination. In this scenario, the software does not verify that the server hostname matches a doma...

Fedora Update for dovecot FEDORA-2012-19752

Check for the Version of dovecot OpenVAS Vulnerability Test Fedora Update for dovecot FEDORA-2012-19752 Authors: System Generated Check Copyright: Copyright c 2013 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the...

Fedora Update for dovecot FEDORA-2012-19752

The remote host is missing an update for the SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptxrefname:"URL",...

Fedora 16 : dovecot-2.0.21-4.fc16 (2012-19752)

do not crash during mail search CVE-2012-5620 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues...

[SECURITY] Fedora 16 Update: dovecot-2.0.21-4.fc16

Dovecot is an IMAP server for Linux/UNIX-like systems, written with security primarily in mind. It also contains a small POP3 server. It supports mail in either of maildir or mbox formats. The SQL drivers and authentication plug-ins are in their subpackages...

Scientific Linux Security Update : nss_ldap on SL5.x i386/x86_64

A race condition was discovered in nssldap which affected certain applications which make LDAP connections, such as Dovecot. This could cause nssldap to answer a request for information about one user with information about a different user. CVE-2007-5794 In addition, these updated packages fix t...