rpm package
suse/dovecot23&distro=SUSE Linux Enterprise Module for Server Applications 15 SP1
pkg:rpm/suse/dovecot23&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Server%20Applications%2015%20SP1
Vulnerabilities (11)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2020-24386 | — | < 2.3.11.3-21.1 | 2.3.11.3-21.1 | Jan 4, 2021 | An issue was discovered in Dovecot before 2.3.13. By using IMAP IDLE, an authenticated attacker can trigger unhibernation via attacker-controlled parameters, leading to access to other users' email messages (and path disclosure). | ||
| CVE-2020-25275 | — | < 2.3.11.3-21.1 | 2.3.11.3-21.1 | Jan 4, 2021 | Dovecot before 2.3.13 has Improper Input Validation in lda, lmtp, and imap, leading to an application crash via a crafted email message with certain choices for ten thousand MIME parts. | ||
| CVE-2020-12674 | — | < 2.3.10-16.1 | 2.3.10-16.1 | Aug 12, 2020 | In Dovecot before 2.3.11.3, sending a specially formatted RPA request will crash the auth service because a length of zero is mishandled. | ||
| CVE-2020-12673 | — | < 2.3.10-16.1 | 2.3.10-16.1 | Aug 12, 2020 | In Dovecot before 2.3.11.3, sending a specially formatted NTLM request will crash the auth service because of an out-of-bounds read. | ||
| CVE-2020-12100 | — | < 2.3.11.3-21.1 | 2.3.11.3-21.1 | Aug 12, 2020 | In Dovecot before 2.3.11.3, uncontrolled recursion in submission, lmtp, and lda allows remote attackers to cause a denial of service (resource consumption) via a crafted e-mail message with deeply nested MIME parts. | ||
| CVE-2020-10967 | — | < 2.3.10-11.1 | 2.3.10-11.1 | May 18, 2020 | In Dovecot before 2.3.10.1, remote unauthenticated attackers can crash the lmtp or submission process by sending mail with an empty localpart. | ||
| CVE-2020-10958 | — | < 2.3.10-11.1 | 2.3.10-11.1 | May 18, 2020 | In Dovecot before 2.3.10.1, a crafted SMTP/LMTP message triggers an unauthenticated use-after-free bug in submission-login, submission, or lmtp, and can lead to a crash under circumstances involving many newlines after a command. | ||
| CVE-2020-10957 | — | < 2.3.10-11.1 | 2.3.10-11.1 | May 18, 2020 | In Dovecot before 2.3.10.1, unauthenticated sending of malformed parameters to a NOOP command causes a NULL Pointer Dereference and crash in submission-login, submission, or lmtp. | ||
| CVE-2019-11500 | — | < 2.3.3-8.1 | 2.3.3-8.1 | Aug 29, 2019 | In Dovecot before 2.2.36.4 and 2.3.x before 2.3.7.2 (and Pigeonhole before 0.5.7.2), protocol processing can fail for quoted strings. This occurs because '\0' characters are mishandled, and can lead to out-of-bounds writes and remote code execution. | ||
| CVE-2019-11494 | — | < 2.3.3-8.1 | 2.3.3-8.1 | May 8, 2019 | In the IMAP Server in Dovecot 2.3.3 through 2.3.5.2, the submission-login service crashes when the client disconnects prematurely during the AUTH command. | ||
| CVE-2019-11499 | — | < 2.3.3-8.1 | 2.3.3-8.1 | May 8, 2019 | In the IMAP Server in Dovecot 2.3.3 through 2.3.5.2, the submission-login component crashes if AUTH PLAIN is attempted over a TLS secured channel with an unacceptable authentication message. |
- CVE-2020-24386Jan 4, 2021affected < 2.3.11.3-21.1fixed 2.3.11.3-21.1
An issue was discovered in Dovecot before 2.3.13. By using IMAP IDLE, an authenticated attacker can trigger unhibernation via attacker-controlled parameters, leading to access to other users' email messages (and path disclosure).
- CVE-2020-25275Jan 4, 2021affected < 2.3.11.3-21.1fixed 2.3.11.3-21.1
Dovecot before 2.3.13 has Improper Input Validation in lda, lmtp, and imap, leading to an application crash via a crafted email message with certain choices for ten thousand MIME parts.
- CVE-2020-12674Aug 12, 2020affected < 2.3.10-16.1fixed 2.3.10-16.1
In Dovecot before 2.3.11.3, sending a specially formatted RPA request will crash the auth service because a length of zero is mishandled.
- CVE-2020-12673Aug 12, 2020affected < 2.3.10-16.1fixed 2.3.10-16.1
In Dovecot before 2.3.11.3, sending a specially formatted NTLM request will crash the auth service because of an out-of-bounds read.
- CVE-2020-12100Aug 12, 2020affected < 2.3.11.3-21.1fixed 2.3.11.3-21.1
In Dovecot before 2.3.11.3, uncontrolled recursion in submission, lmtp, and lda allows remote attackers to cause a denial of service (resource consumption) via a crafted e-mail message with deeply nested MIME parts.
- CVE-2020-10967May 18, 2020affected < 2.3.10-11.1fixed 2.3.10-11.1
In Dovecot before 2.3.10.1, remote unauthenticated attackers can crash the lmtp or submission process by sending mail with an empty localpart.
- CVE-2020-10958May 18, 2020affected < 2.3.10-11.1fixed 2.3.10-11.1
In Dovecot before 2.3.10.1, a crafted SMTP/LMTP message triggers an unauthenticated use-after-free bug in submission-login, submission, or lmtp, and can lead to a crash under circumstances involving many newlines after a command.
- CVE-2020-10957May 18, 2020affected < 2.3.10-11.1fixed 2.3.10-11.1
In Dovecot before 2.3.10.1, unauthenticated sending of malformed parameters to a NOOP command causes a NULL Pointer Dereference and crash in submission-login, submission, or lmtp.
- CVE-2019-11500Aug 29, 2019affected < 2.3.3-8.1fixed 2.3.3-8.1
In Dovecot before 2.2.36.4 and 2.3.x before 2.3.7.2 (and Pigeonhole before 0.5.7.2), protocol processing can fail for quoted strings. This occurs because '\0' characters are mishandled, and can lead to out-of-bounds writes and remote code execution.
- CVE-2019-11494May 8, 2019affected < 2.3.3-8.1fixed 2.3.3-8.1
In the IMAP Server in Dovecot 2.3.3 through 2.3.5.2, the submission-login service crashes when the client disconnects prematurely during the AUTH command.
- CVE-2019-11499May 8, 2019affected < 2.3.3-8.1fixed 2.3.3-8.1
In the IMAP Server in Dovecot 2.3.3 through 2.3.5.2, the submission-login component crashes if AUTH PLAIN is attempted over a TLS secured channel with an unacceptable authentication message.