Note:
This project will be discontinued after December 13, 2021. [more]
Product:
Dovecot
(Dovecot)Repositories | https://github.com/dovecot/core |
#Vulnerabilities | 53 |
Date | Id | Summary | Products | Score | Patch | Annotated |
---|---|---|---|---|---|---|
2020-05-18 | CVE-2020-10957 | In Dovecot before 2.3.10.1, unauthenticated sending of malformed parameters to a NOOP command causes a NULL Pointer Dereference and crash in submission-login, submission, or lmtp. | Dovecot | 7.5 | ||
2020-05-18 | CVE-2020-10958 | In Dovecot before 2.3.10.1, a crafted SMTP/LMTP message triggers an unauthenticated use-after-free bug in submission-login, submission, or lmtp, and can lead to a crash under circumstances involving many newlines after a command. | Dovecot | 5.3 | ||
2020-05-18 | CVE-2020-10967 | In Dovecot before 2.3.10.1, remote unauthenticated attackers can crash the lmtp or submission process by sending mail with an empty localpart. | Dovecot | 5.3 | ||
2020-08-12 | CVE-2020-12100 | In Dovecot before 2.3.11.3, uncontrolled recursion in submission, lmtp, and lda allows remote attackers to cause a denial of service (resource consumption) via a crafted e-mail message with deeply nested MIME parts. | Ubuntu_linux, Debian_linux, Dovecot, Fedora | 7.5 | ||
2020-08-12 | CVE-2020-12673 | In Dovecot before 2.3.11.3, sending a specially formatted NTLM request will crash the auth service because of an out-of-bounds read. | Ubuntu_linux, Debian_linux, Dovecot, Fedora | 7.5 | ||
2020-08-12 | CVE-2020-12674 | In Dovecot before 2.3.11.3, sending a specially formatted RPA request will crash the auth service because a length of zero is mishandled. | Ubuntu_linux, Debian_linux, Dovecot, Fedora | 7.5 | ||
2021-01-04 | CVE-2020-24386 | An issue was discovered in Dovecot before 2.3.13. By using IMAP IDLE, an authenticated attacker can trigger unhibernation via attacker-controlled parameters, leading to access to other users' email messages (and path disclosure). | Debian_linux, Dovecot, Fedora | 6.8 | ||
2021-01-04 | CVE-2020-25275 | Dovecot before 2.3.13 has Improper Input Validation in lda, lmtp, and imap, leading to an application crash via a crafted email message with certain choices for ten thousand MIME parts. | Debian_linux, Dovecot, Fedora | 7.5 | ||
2021-06-28 | CVE-2021-29157 | Dovecot before 2.3.15 allows ../ Path Traversal. An attacker with access to the local filesystem can trick OAuth2 authentication into using an HS256 validation key from an attacker-controlled location. This occurs during use of local JWT validation with the posix fs driver. | Dovecot, Fedora | 5.5 | ||
2021-06-28 | CVE-2020-28200 | The Sieve engine in Dovecot before 2.3.15 allows Uncontrolled Resource Consumption, as demonstrated by a situation with a complex regular expression for the regex extension. | Dovecot, Fedora | 4.3 |