Branch c7.1 update bulletin.

Package dovecot updated to version 2.2.30.2-alt0.M70C.2 for branch c7.1 in task 236909.

Published: 2019-08-28

BDU:2019-03214

Уязвимость агента доставки электронной почты Dovecot, связанная с возможностью записи за пределами границ памяти, позволяющая нарушителю выполнить произвольный код

Severity: CRITICAL (9.8) Vector: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References:

CVE-2019-11500

Published: 2019-08-29
Modified: 2024-11-21

CVE-2019-11500

In Dovecot before 2.2.36.4 and 2.3.x before 2.3.7.2 (and Pigeonhole before 0.5.7.2), protocol processing can fail for quoted strings. This occurs because '\0' characters are mishandled, and can lead to out-of-bounds writes and remote code execution.

Severity: CRITICAL (9.8) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References:

Version: 2.1.0

Branch c7.1 update on 2019-09-03

ALT-BU-2019-3915-1

ALT-PU-2019-2605-1

Closed vulnerabilities

BDU:2019-03214

CVE-2019-11500