Vulnerabilities (CVE)

Filtered by vendor Dovecot Subscribe
Total 53 CVE
CVE Vendors Products Updated CVSS v2 CVSS v3
CVE-2019-10691 2 Dovecot, Opensuse 2 Dovecot, Leap 2024-11-21 5.0 MEDIUM 7.5 HIGH
The JSON encoder in Dovecot before 2.3.5.2 allows attackers to repeatedly crash the authentication service by attempting to authenticate with an invalid UTF-8 sequence as the username.
CVE-2017-2669 2 Debian, Dovecot 2 Debian Linux, Dovecot 2024-11-21 5.0 MEDIUM 3.7 LOW
Dovecot before version 2.2.29 is vulnerable to a denial of service. When 'dict' passdb and userdb were used for user authentication, the username sent by the IMAP/POP3 client was sent through var_expand() to perform %variable expansion. Sending specially crafted %variable fields could result in excessive memory usage causing the process to crash (and restart), or excessive CPU usage causing all authentications to hang.
CVE-2017-15132 3 Canonical, Debian, Dovecot 3 Ubuntu Linux, Debian Linux, Dovecot 2024-11-21 5.0 MEDIUM 7.5 HIGH
A flaw was found in dovecot 2.0 up to 2.2.33 and 2.3.0. An abort of SASL authentication results in a memory leak in dovecot's auth client used by login processes. The leak has impact in high performance configuration where same login processes are reused and can cause the process to crash due to memory exhaustion.
CVE-2017-15130 3 Canonical, Debian, Dovecot 3 Ubuntu Linux, Debian Linux, Dovecot 2024-11-21 4.3 MEDIUM 5.9 MEDIUM
A denial of service flaw was found in dovecot before 2.2.34. An attacker able to generate random SNI server names could exploit TLS SNI configuration lookups, leading to excessive memory usage and the process to restart.
CVE-2017-14461 3 Debian, Dovecot, Ubuntu 3 Debian Linux, Dovecot, Ubuntu 2024-11-21 5.5 MEDIUM 5.9 MEDIUM
A specially crafted email delivered over SMTP and passed on to Dovecot by MTA can trigger an out of bounds read resulting in potential sensitive information disclosure and denial of service. In order to trigger this vulnerability, an attacker needs to send a specially crafted email message to the server.
CVE-2016-8652 1 Dovecot 1 Dovecot 2024-11-21 4.3 MEDIUM 5.9 MEDIUM
The auth component in Dovecot before 2.2.27, when auth-policy is configured, allows a remote attackers to cause a denial of service (crash) by aborting authentication without setting a username.
CVE-2016-4983 3 Dovecot, Opensuse, Redhat 4 Dovecot, Leap, Opensuse and 1 more 2024-11-21 2.1 LOW 3.3 LOW
A postinstall script in the dovecot rpm allows local users to read the contents of newly created SSL/TLS key files.
CVE-2015-3420 2 Dovecot, Fedoraproject 2 Dovecot, Fedora 2024-11-21 4.3 MEDIUM 5.9 MEDIUM
The ssl-proxy-openssl.c function in Dovecot before 2.2.17, when SSLv3 is disabled, allow remote attackers to cause a denial of service (login process crash) via vectors related to handshake failures.
CVE-2014-3430 1 Dovecot 1 Dovecot 2024-11-21 5.0 MEDIUM N/A
Dovecot 1.1 before 2.2.13 and dovecot-ee before 2.1.7.7 and 2.2.x before 2.2.12.12 does not properly close old connections, which allows remote attackers to cause a denial of service (resource consumption) via an incomplete SSL/TLS handshake for an IMAP/POP3 connection.
CVE-2013-6171 1 Dovecot 1 Dovecot 2024-11-21 5.8 MEDIUM N/A
checkpassword-reply in Dovecot before 2.2.7 performs setuid operations to a user who is authenticating, which allows local users to bypass authentication and access virtual email accounts by attaching to the process and using a restricted file descriptor to modify account information in the response to the dovecot-auth server.
CVE-2013-2111 1 Dovecot 1 Dovecot 2024-11-21 5.0 MEDIUM N/A
The IMAP functionality in Dovecot before 2.2.2 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via invalid APPEND parameters.
CVE-2011-4318 1 Dovecot 1 Dovecot 2024-11-21 5.8 MEDIUM N/A
Dovecot 2.0.x before 2.0.16, when ssl or starttls is enabled and hostname is used to define the proxy destination, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a valid certificate for a different hostname.
CVE-2011-2167 1 Dovecot 1 Dovecot 2024-11-21 6.5 MEDIUM N/A
script-login in Dovecot 2.0.x before 2.0.13 does not follow the chroot configuration setting, which might allow remote authenticated users to conduct directory traversal attacks by leveraging a script.
CVE-2011-2166 1 Dovecot 1 Dovecot 2024-11-21 6.5 MEDIUM N/A
script-login in Dovecot 2.0.x before 2.0.13 does not follow the user and group configuration settings, which might allow remote authenticated users to bypass intended access restrictions by leveraging a script.
CVE-2011-1929 1 Dovecot 1 Dovecot 2024-11-21 5.0 MEDIUM N/A
lib-mail/message-header-parser.c in Dovecot 1.2.x before 1.2.17 and 2.0.x before 2.0.13 does not properly handle '\0' characters in header names, which allows remote attackers to cause a denial of service (daemon crash or mailbox corruption) via a crafted e-mail message.
CVE-2010-3780 1 Dovecot 1 Dovecot 2024-11-21 4.0 MEDIUM N/A
Dovecot 1.2.x before 1.2.15 allows remote authenticated users to cause a denial of service (master process outage) by simultaneously disconnecting many (1) IMAP or (2) POP3 sessions.
CVE-2010-3779 1 Dovecot 1 Dovecot 2024-11-21 3.5 LOW N/A
Dovecot 1.2.x before 1.2.15 and 2.0.x before 2.0.beta2 grants the admin permission to the owner of each mailbox in a non-public namespace, which might allow remote authenticated users to bypass intended access restrictions by changing the ACL of a mailbox, as demonstrated by a symlinked shared mailbox.
CVE-2010-3707 1 Dovecot 1 Dovecot 2024-11-21 5.5 MEDIUM N/A
plugins/acl/acl-backend-vfile.c in Dovecot 1.2.x before 1.2.15 and 2.0.x before 2.0.5 interprets an ACL entry as a directive to add to the permissions granted by another ACL entry, instead of a directive to replace the permissions granted by another ACL entry, in certain circumstances involving more specific entries that occur after less specific entries, which allows remote authenticated users to bypass intended access restrictions via a request to read or modify a mailbox.
CVE-2010-3706 1 Dovecot 1 Dovecot 2024-11-21 5.5 MEDIUM N/A
plugins/acl/acl-backend-vfile.c in Dovecot 1.2.x before 1.2.15 and 2.0.x before 2.0.5 interprets an ACL entry as a directive to add to the permissions granted by another ACL entry, instead of a directive to replace the permissions granted by another ACL entry, in certain circumstances involving the private namespace of a user, which allows remote authenticated users to bypass intended access restrictions via a request to read or modify a mailbox.
CVE-2010-3304 1 Dovecot 1 Dovecot 2024-11-21 6.4 MEDIUM N/A
The ACL plugin in Dovecot 1.2.x before 1.2.13 propagates INBOX ACLs to newly created mailboxes in certain configurations, which might allow remote attackers to read mailboxes that have unintended weak ACLs.