ALT-PU-2020-1989-1
Closed vulnerabilities
Published: 2019-12-13
Modified: 2024-11-21
Modified: 2024-11-21
CVE-2019-19722
In Dovecot before 2.3.9.2, an attacker can crash a push-notification driver with a crafted email when push notifications are used, because of a NULL Pointer Dereference. The email must use a group address as either the sender or the recipient.
Severity: MEDIUM (5.3)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
References:
- http://www.openwall.com/lists/oss-security/2019/12/13/3
- http://www.openwall.com/lists/oss-security/2019/12/13/3
- https://dovecot.org/list/dovecot-news/2019-December/000428.html
- https://dovecot.org/list/dovecot-news/2019-December/000428.html
- https://dovecot.org/pipermail/dovecot-news/2019-December/000428.html
- https://dovecot.org/pipermail/dovecot-news/2019-December/000428.html
- https://dovecot.org/security.html
- https://dovecot.org/security.html
- FEDORA-2019-5898f4f935
- FEDORA-2019-5898f4f935
- FEDORA-2019-72e5ac943a
- FEDORA-2019-72e5ac943a
Published: 2020-05-18
Modified: 2024-11-21
Modified: 2024-11-21
CVE-2020-10957
In Dovecot before 2.3.10.1, unauthenticated sending of malformed parameters to a NOOP command causes a NULL Pointer Dereference and crash in submission-login, submission, or lmtp.
Severity: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References:
- openSUSE-SU-2020:0720
- http://packetstormsecurity.com/files/157771/Open-Xchange-Dovecot-2.3.10-Null-Pointer-Dereference-Denial-Of-Service.html
- 20200519 Multiple vulnerabilities in Dovecot IMAP server
- [oss-security] 20200518 Multiple vulnerabilities in Dovecot IMAP server
- https://dovecot.org/security
- FEDORA-2020-b60344c987
- FEDORA-2020-1dee17d880
- USN-4361-1
- DSA-4690
- https://www.openwall.com/lists/oss-security/2020/05/18/1
- openSUSE-SU-2020:0720
- https://www.openwall.com/lists/oss-security/2020/05/18/1
- DSA-4690
- USN-4361-1
- FEDORA-2020-1dee17d880
- FEDORA-2020-b60344c987
- https://dovecot.org/security
- [oss-security] 20200518 Multiple vulnerabilities in Dovecot IMAP server
- 20200519 Multiple vulnerabilities in Dovecot IMAP server
- http://packetstormsecurity.com/files/157771/Open-Xchange-Dovecot-2.3.10-Null-Pointer-Dereference-Denial-Of-Service.html
Published: 2020-05-18
Modified: 2024-11-21
Modified: 2024-11-21
CVE-2020-10958
In Dovecot before 2.3.10.1, a crafted SMTP/LMTP message triggers an unauthenticated use-after-free bug in submission-login, submission, or lmtp, and can lead to a crash under circumstances involving many newlines after a command.
Severity: MEDIUM (5.3)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
References:
- openSUSE-SU-2020:0720
- http://packetstormsecurity.com/files/157771/Open-Xchange-Dovecot-2.3.10-Null-Pointer-Dereference-Denial-Of-Service.html
- 20200519 Multiple vulnerabilities in Dovecot IMAP server
- [oss-security] 20200518 Multiple vulnerabilities in Dovecot IMAP server
- https://dovecot.org/security
- FEDORA-2020-b60344c987
- FEDORA-2020-1dee17d880
- USN-4361-1
- DSA-4690
- https://www.openwall.com/lists/oss-security/2020/05/18/1
- openSUSE-SU-2020:0720
- https://www.openwall.com/lists/oss-security/2020/05/18/1
- DSA-4690
- USN-4361-1
- FEDORA-2020-1dee17d880
- FEDORA-2020-b60344c987
- https://dovecot.org/security
- [oss-security] 20200518 Multiple vulnerabilities in Dovecot IMAP server
- 20200519 Multiple vulnerabilities in Dovecot IMAP server
- http://packetstormsecurity.com/files/157771/Open-Xchange-Dovecot-2.3.10-Null-Pointer-Dereference-Denial-Of-Service.html
Published: 2020-05-18
Modified: 2024-11-21
Modified: 2024-11-21
CVE-2020-10967
In Dovecot before 2.3.10.1, remote unauthenticated attackers can crash the lmtp or submission process by sending mail with an empty localpart.
Severity: MEDIUM (5.3)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
References:
- openSUSE-SU-2020:0720
- http://packetstormsecurity.com/files/157771/Open-Xchange-Dovecot-2.3.10-Null-Pointer-Dereference-Denial-Of-Service.html
- 20200519 Multiple vulnerabilities in Dovecot IMAP server
- [oss-security] 20200518 Multiple vulnerabilities in Dovecot IMAP server
- https://dovecot.org/security
- FEDORA-2020-cd8b8f887b
- FEDORA-2020-d737c57172
- FEDORA-2020-b60344c987
- FEDORA-2020-1dee17d880
- FEDORA-2020-b8ebc4201e
- USN-4361-1
- DSA-4690
- https://www.openwall.com/lists/oss-security/2020/05/18/1
- openSUSE-SU-2020:0720
- https://www.openwall.com/lists/oss-security/2020/05/18/1
- DSA-4690
- USN-4361-1
- FEDORA-2020-b8ebc4201e
- FEDORA-2020-1dee17d880
- FEDORA-2020-b60344c987
- FEDORA-2020-d737c57172
- FEDORA-2020-cd8b8f887b
- https://dovecot.org/security
- [oss-security] 20200518 Multiple vulnerabilities in Dovecot IMAP server
- 20200519 Multiple vulnerabilities in Dovecot IMAP server
- http://packetstormsecurity.com/files/157771/Open-Xchange-Dovecot-2.3.10-Null-Pointer-Dereference-Denial-Of-Service.html
Closed bugs
Отсутствует файл для tmpfiles.d, описывающий /var/run/dovecot