36 matches found
CentOS Linux 7 [TuxCare] Security Update: dovecot / dovecot-devel / dovecot-mysql / dovecot-pgsql / etc (CENTOS7:CLSA-2026:1792764059)
The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2026:1792764059 advisory. - An attacker that has valid credentials can use a Sieve script with the editheader extension to trigger a use-after-free in the mail editing cod...
CLSA-2026-1792596933 dovecot: Fix of CVE-2026-42007
CVE-2026-42007: pigeonhole: sieve editheader: reset header-index first pointers before rebuilding the index and copy raw header data with memcpy instead of istrndup...
AlmaLinux 9.6 [TuxCare] Security Update: dovecot / dovecot-devel / dovecot-mysql / dovecot-pgsql / etc (ALMALINUX9.6:CLSA-2026:1792596933)
The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1792596933 advisory. - An attacker that has valid credentials can use a Sieve script with the editheader extension to trigger a use-after-free in the mail editing...
Rocky Linux 9.6 [TuxCare] Security Update: dovecot / dovecot-devel / dovecot-mysql / dovecot-pgsql / etc (ALMALINUX9.6:CLSA-2026:1792596933)
The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1792596933 advisory. - An attacker that has valid credentials can use a Sieve script with the editheader extension to trigger a use-after-free in the mail editi...
CVE-2026-107566
Missing authorization in the Sieve editheader action 6.2.22 through 6.3.6 and in the mail-rule Set header value action 6.0.0 through 6.3.6 of Progressive Robot hMailServer allows an authenticated user to make the server send mail as any address, DKIM-signed where the address is at a domain the...
CVE-2026-107566 Missing Authorization in hMailServer
Missing authorization in the Sieve editheader action 6.2.22 through 6.3.6 and in the mail-rule Set header value action 6.0.0 through 6.3.6 of Progressive Robot hMailServer allows an authenticated user to make the server send mail as any address, DKIM-signed where the address is at a domain the...
CVE-2026-107566 Missing Authorization in hMailServer
Missing authorization in the Sieve editheader action 6.2.22 through 6.3.6 and in the mail-rule Set header value action 6.0.0 through 6.3.6 of Progressive Robot hMailServer allows an authenticated user to make the server send mail as any address, DKIM-signed where the address is at a domain the...
EUVD-2026-104408
Missing authorization in the Sieve editheader action 6.2.22 through 6.3.6 and in the mail-rule Set header value action 6.0.0 through 6.3.6 of Progressive Robot hMailServer allows an authenticated user to make the server send mail as any address, DKIM-signed where the address is at a domain the...
CVE-2026-107566
Progressive Robot hMailServer versions 6.2.22 through 6.3.6 are vulnerable to a missing authorization flaw in the Sieve editheader action and the mail-rule Set header value action (v6.0.0 through 6.3.6). This allows an authenticated user to manipulate headers such as From , Sender , and DKIM-Sign...
PT-2026-117453
Name of the Vulnerable Software and Affected Versions Progressive Robot hMailServer versions 6.2.22 through 6.3.6 Progressive Robot hMailServer versions 6.0.0 through 6.3.6 Description Missing authorization in the Sieve editheader action and the mail-rule Set header value action allows an...
CVE-2026-107566: Missing Authorization
Missing authorization in the Sieve editheader action 6.2.22 through 6.3.6 and in the mail-rule Set header value action 6.0.0 through 6.3.6 of Progressive Robot hMailServer allows an authenticated user to make the server send mail as any address, DKIM-signed where the address is at a domain the...
Progressive Robot hMailServer authorization issue vulnerability
The Progressive Robot hMailServer version 6.0.0 to 6.3.6 has an authorization issue vulnerability. This vulnerability stems from the lack of authorization for the “Sieve editheader” operation and the “mail rule Set header value” operation. As a result, authenticated users may send emails from...
Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: dovecot (UTSA-2026-130075)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-130075 advisory. An attacker that has valid credentials can use a Sieve script with the editheader extension to trigger a use-after-free in the mail editing code, and to write memory...
dovecot: Dovecot: Arbitrary Code Execution via Sieve editheader use-after-free
A flaw was found in Dovecot. An authenticated attacker can use a Sieve script with the editheader extension to trigger a use-after-free vulnerability in the mail editing code. This can lead to memory corruption, potentially crashing the mail delivery process and allowing for arbitrary code...
dovecot: Dovecot: Arbitrary Code Execution via Sieve editheader use-after-free
A flaw was found in Dovecot. An authenticated attacker can use a Sieve script with the editheader extension to trigger a use-after-free vulnerability in the mail editing code. This can lead to memory corruption, potentially crashing the mail delivery process and allowing for arbitrary code...
dovecot security update
1:2.3.21-19.8 - fix CVE-2026-33605: ManageSieve: denial of service via lone CR character causing protocol deadlock RHEL-251984 1:2.3.21-19.7 - fix CVE-2026-42007: fix use-after-free and info leak in sieve editheader extension RHEL-251945 1:2.3.21-19.6 - fix CVE-2026-40018: incorrect escaping of...
dovecot: Dovecot: Arbitrary Code Execution via Sieve editheader use-after-free
A flaw was found in Dovecot. An authenticated attacker can use a Sieve script with the editheader extension to trigger a use-after-free vulnerability in the mail editing code. This can lead to memory corruption, potentially crashing the mail delivery process and allowing for arbitrary code...
Important: dovecot
Issue Overview: An attacker that can send mail to a user can craft a message whose headers contain a very large number of email addresses or MIME parameters, which causes excessive memory usage when the message is later parsed. The message is still delivered, but reading it over IMAP can exhaust...
OPENSUSE-SU-2026:21720-1 Security update for dovecot24
This update for dovecot24 fixes the following issues: Update to 2.4.5. - CVE-2026-33263: submission-login: panic when mailmaxuseripconnections is reached bsc1276794. - CVE-2026-27852: DoS by sending mail with bad header bsc1276799. - CVE-2026-33604: SMTP smuggling via missing dot-stuffing after...
CVE-2026-42007
A flaw was found in Dovecot. An authenticated attacker can use a Sieve script with the editheader extension to trigger a use-after-free vulnerability in the mail editing code. This can lead to memory corruption, potentially crashing the mail delivery process and allowing for arbitrary code...