All errata/p9/ALT-PU-2019-2570-1
ALT-PU-2019-2570-1

Package update dovecot in branch p9

Version2.3.7.2-alt1
Task#236729
Published2019-08-29
Max severityCRITICAL
Severity:

Closed issues (2)

BDU:2019-03214
CRITICAL9.8

Уязвимость агента доставки электронной почты Dovecot, связанная с возможностью записи за пределами границ памяти, позволяющая нарушителю выполнить произвольный код

Published: 2019-09-19Modified: 2023-11-21
CVSS 3.xCRITICAL 9.8
CVSS:3.x/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0CRITICAL 10.0
CVSS:2.0/AV:N/AC:L/Au:N/C:C/I:C/A:C
References
CVE-2019-11500
CRITICAL9.8

In Dovecot before 2.2.36.4 and 2.3.x before 2.3.7.2 (and Pigeonhole before 0.5.7.2), protocol processing can fail for quoted strings. This occurs because '\0' characters are mishandled, and can lead to out-of-bounds writes and remote code execution.

Published: 2019-08-29Modified: 2024-11-21
CVSS 2.0HIGH 7.5
CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:P
CVSS 3.xCRITICAL 9.8
CVSS:3.x/CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References