Every CVE Search/ Get API key

CVE-2019-11500

In Dovecot before 2.2.36.4 and 2.3.x before 2.3.7.2 (and Pigeonhole before 0.5.7.2), protocol...

9.8 CriticalFix available

In Dovecot before 2.2.36.4 and 2.3.x before 2.3.7.2 (and Pigeonhole before 0.5.7.2), protocol processing can fail for quoted strings. This occurs because '\0' characters are mishandled, and can lead to out-of-bounds writes and remote code execution.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

62.3%Up 56.2 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 9.8

In Dovecot before 2.2.36.4 and 2.3.x before 2.3.7.2 (and Pigeonhole before 0.5.7.2), protocol processing can fail for quoted strings. This occurs because '\0' characters are mishandled, and can lead to out-of-bounds writes and remote code execution.

Record
CVE-2019-11500
CVSS 3.0
9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0
7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness
CWE-787
Updated
2026-11-02
CVE List No score

In Dovecot before 2.2.36.4 and 2.3.x before 2.3.7.2 (and Pigeonhole before 0.5.7.2), protocol processing can fail for quoted strings. This occurs because '\0' characters are mishandled, and can lead to out-of-bounds writes and remote code execution.

Record
CVE-2019-11500
Updated
2026-11-02
EUVDEUVD-2019-3173 No score

In Dovecot before 2.2.36.4 and 2.3.x before 2.3.7.2 (and Pigeonhole before 0.5.7.2), protocol processing can fail for quoted strings. This occurs because '\0' characters are mishandled, and can lead to out-of-bounds writes and remote code execution.

Record
EUVD-2019-3173
Updated
2026-11-03
GitHub AdvisoriesGHSA-mqm8-r3v6-8mmv 9.8

In Dovecot before 2.2.36.4 and 2.3.x before 2.3.7.2 (and Pigeonhole before 0.5.7.2), protocol...

In Dovecot before 2.2.36.4 and 2.3.x before 2.3.7.2 (and Pigeonhole before 0.5.7.2), protocol processing can fail for quoted strings. This occurs because '\0' characters are mishandled, and can lead to out-of-bounds writes and remote code execution.

Record
GHSA-mqm8-r3v6-8mmv
CVSS 3.0
9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-787
Updated
2026-11-02
OSVALPINE-CVE-2019-11500 9.8

In Dovecot before 2.2.36.4 and 2.3.x before 2.3.7.2 (and Pigeonhole before 0.5.7.2), protocol processing can fail for quoted strings. This occurs because '\0' characters are mishandled, and can lead to out-of-bounds writes and remote code execution.

Record
ALPINE-CVE-2019-11500
CVSS 3.0
9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSV 9.8

In Dovecot before 2.2.36.4 and 2.3.x before 2.3.7.2 (and Pigeonhole before 0.5.7.2), protocol processing can fail for quoted strings. This occurs because '\0' characters are mishandled, and can lead to out-of-bounds writes and remote code execution.

Record
CVE-2019-11500
CVSS 3.0
9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 16 moreShow less
OSVDEBIAN-CVE-2019-11500 9.8

In Dovecot before 2.2.36.4 and 2.3.x before 2.3.7.2 (and Pigeonhole before 0.5.7.2), protocol processing can fail for quoted strings. This occurs because '\0' characters are mishandled, and can lead to out-of-bounds writes and remote code execution.

Record
DEBIAN-CVE-2019-11500
CVSS 3.0
9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2019:2822 8.1

Red Hat Security Advisory: dovecot security update

Record
RHSA-2019:2822
CVSS 3.0
8.1 HighCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2019:2836 8.1

Red Hat Security Advisory: dovecot security update

Record
RHSA-2019:2836
CVSS 3.0
8.1 HighCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2019:2885 8.1

Red Hat Security Advisory: dovecot security update

Record
RHSA-2019:2885
CVSS 3.0
8.1 HighCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2019-11500 9.8

In Dovecot before 2.2.36.4 and 2.3.x before 2.3.7.2 (and Pigeonhole before 0.5.7.2), protocol processing can fail for quoted strings. This occurs because '\0' characters are mishandled, and can lead to out-of-bounds writes and remote code execution.

Record
UBUNTU-CVE-2019-11500
CVSS 3.0
9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVMGASA-2019-0261 No score

Updated dovecot packages fix security vulnerability

Updated dovecot packages fix security vulnerability:

IMAP protocol parser does not properly handle NUL byte when scanning data in quoted strings, leading to out of bounds heap memory writes.

Record
MGASA-2019-0261
Updated
2026-11-02
OSVopenSUSE-SU-2019:2278-1 No score

Security update for dovecot23

This update for dovecot23 fixes the following issue:

  • CVE-2019-11500: Fixed the NUL byte handling in IMAP and ManageSieve protocol parsers. (bsc#1145559)
  • CVE-2019-11499: Fixed a vulnerability where the submission-login would crash over a TLS secured channel (bsc#1133625).
  • CVE-2019-11494: Fixed a denial of service if the authentication is aborted by disconnecting (bsc#1133624).

This update was imported from the SUSE:SLE-15:Update update project.

Record
openSUSE-SU-2019:2278-1
Updated
2026-11-02
OSVopenSUSE-SU-2019:2281-1 No score

Security update for dovecot23

This update for dovecot23 fixes the following issues:

  • CVE-2019-11500: Fixed the NUL byte handling in IMAP and ManageSieve protocol parsers. (bsc#1145559)
  • CVE-2019-11499: Fixed a vulnerability where the submission-login would crash over a TLS secured channel (bsc#1133625).
  • CVE-2019-11494: Fixed a denial of service if the authentication is aborted by disconnecting (bsc#1133624).

This update was imported from the SUSE:SLE-15-SP1:Update update project.

Record
openSUSE-SU-2019:2281-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:10726-1 No score

dovecot23-2.3.16-1.6 on GA media

These are all security issues fixed in the dovecot23-2.3.16-1.6 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10726-1
Updated
2026-11-02
OSVopenSUSE-SU-2025:14715-1 No score

dovecot24-2.4.0-1.1 on GA media

These are all security issues fixed in the dovecot24-2.4.0-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2025:14715-1
Updated
2026-11-02
OSVSUSE-SU-2019:2454-1 No score

Security update for dovecot22

This update for dovecot22 fixes the following issues:

  • CVE-2019-11500: Fixed a potential remote code execution in the IMAP and ManageSieve protocol parsers (bsc#1145559).
Record
SUSE-SU-2019:2454-1
Updated
2026-11-02
OSVSUSE-SU-2019:2514-1 No score

Security update for dovecot23

This update for dovecot23 fixes the following issues:

  • CVE-2019-11500: Fixed the NUL byte handling in IMAP and ManageSieve protocol parsers. (bsc#1145559)
  • CVE-2019-11499: Fixed a vulnerability where the submission-login would crash over a TLS secured channel (bsc#1133625).
  • CVE-2019-11494: Fixed a denial of service if the authentication is aborted by disconnecting (bsc#1133624).
Record
SUSE-SU-2019:2514-1
Updated
2026-11-02
OSVUSN-4110-1 No score

dovecot vulnerability

Nick Roessler and Rafi Rubin discovered that Dovecot incorrectly handled certain data. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code.

Record
USN-4110-1
Updated
2026-11-02
OSVUSN-4110-2 No score

dovecot vulnerability

USN-4110-1 fixed a vulnerability in Dovecot. This update provides the corresponding update for Ubuntu 12.04 ESM and Ubuntu 14.04 ESM.

Original advisory details:

Nick Roessler and Rafi Rubin discovered that Dovecot incorrectly handled certain data. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code.

Record
USN-4110-2
Updated
2026-11-02
OSVUSN-4110-3 No score

Dovecot regression

USN-4110-1 fixed a vulnerability in Dovecot. The update introduced a regression causing a wrong check. This update fixes the problem.

We apologize for the inconvenience.

Original advisory details:

Nick Roessler and Rafi Rubin discovered that Dovecot incorrectly handled certain data. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code.

Record
USN-4110-3
Updated
2026-11-02
OSVUSN-4110-4 No score

dovecot regression

USN-4110-1 fixed a vulnerability in Dovecot. The update introduced a regression causing a wrong check. This update fixes the problem for Ubuntu 12.04 ESM and Ubuntu 14.04 ESM.

We apologize for the inconvenience.

Original advisory details:

Nick Roessler and Rafi Rubin discovered that Dovecot incorrectly handled certain data. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code.

Record
USN-4110-4
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
dovecot
Alpine:v3.10
 2.3.0 up to 2.3.7.2-r0
2.3.7.2-r0
dovecot
Alpine:v3.11
 2.3.0 up to 2.3.7.2-r0
2.3.7.2-r0
dovecot
Alpine:v3.12
 2.3.0 up to 2.3.7.2-r0
2.3.7.2-r0
dovecot
Alpine:v3.13
 2.3.0 up to 2.3.7.2-r0
2.3.7.2-r0
dovecot
Alpine:v3.14
 2.3.0 up to 2.3.7.2-r0
2.3.7.2-r0
dovecot
Alpine:v3.15
 2.3.0 up to 2.3.7.2-r0
2.3.7.2-r0
dovecot
Alpine:v3.16
 2.3.0 up to 2.3.7.2-r0
2.3.7.2-r0
dovecot
Alpine:v3.17
 2.3.0 up to 2.3.7.2-r0
2.3.7.2-r0
dovecot
Alpine:v3.18
 2.3.0 up to 2.3.7.2-r0
2.3.7.2-r0
dovecot
Alpine:v3.19
 2.3.0 up to 2.3.7.2-r0
2.3.7.2-r0
Show 86 moreShow less
Affected packages
PackageAffectedFixed
dovecot
Alpine:v3.20
 2.3.0 up to 2.3.7.2-r0
2.3.7.2-r0
dovecot
Alpine:v3.21
 2.3.0 up to 2.3.7.2-r0
2.3.7.2-r0
dovecot
Alpine:v3.22
 2.3.0 up to 2.3.7.2-r0
2.3.7.2-r0
dovecot
Alpine:v3.23
 2.3.0 up to 2.3.7.2-r0
2.3.7.2-r0
dovecot
Alpine:v3.24
 2.3.0 up to 2.3.7.2-r0
2.3.7.2-r0
dovecot
Alpine:v3.7
 2.3.0 up to 2.2.36.4-r0
2.2.36.4-r0
dovecot
Alpine:v3.8
 2.3.0 up to 2.3.7.2-r0
2.3.7.2-r0
dovecot
Alpine:v3.9
 2.3.0 up to 2.3.7.2-r0
2.3.7.2-r0
dovecot
Debian:12
 before 1:2.3.7.2-1
1:2.3.7.2-1
dovecot
Debian:13
 before 1:2.3.7.2-1
1:2.3.7.2-1
dovecot
Debian:14
 before 1:2.3.7.2-1
1:2.3.7.2-1
dovecot
Debian:8
 before 1:2.2.13-12~deb8u7, plus listed versions
1:2.2.13-111:2.2.13-12~deb8u11:2.2.13-12~deb8u21:2.2.13-12~deb8u31:2.2.13-12~deb8u41:2.2.13-12~deb8u51:2.2.13-12~deb8u6
1:2.2.13-12~deb8u7
dovecot
Debian:9
 before 1:2.2.27-3+deb9u5, plus listed versions
1:2.2.27-31:2.2.27-3+deb9u11:2.2.27-3+deb9u21:2.2.27-3+deb9u2~bpo8+11:2.2.27-3+deb9u31:2.2.27-3+deb9u4
1:2.2.27-3+deb9u5
dovecot
Debian:10
 before 1:2.3.4.1-5+deb10u1, plus listed versions
1:2.3.4.1-51:2.3.4.1-5+deb10u1~bpo9+1
1:2.3.4.1-5+deb10u1
dovecot
Mageia:6
 before 2.2.36.4-1.mga6
2.2.36.4-1.mga6
dovecot
Mageia:7
 before 2.3.7.2-1.mga7
2.3.7.2-1.mga7
dovecot
Red Hat:enterprise_linux:8::appstream
 before 1:2.2.36-5.el8_0.1
1:2.2.36-5.el8_0.1
dovecot-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 1:2.2.36-5.el8_0.1
1:2.2.36-5.el8_0.1
dovecot-debugsource
Red Hat:enterprise_linux:8::appstream
 before 1:2.2.36-5.el8_0.1
1:2.2.36-5.el8_0.1
dovecot-mysql
Red Hat:enterprise_linux:8::appstream
 before 1:2.2.36-5.el8_0.1
1:2.2.36-5.el8_0.1
dovecot-mysql-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 1:2.2.36-5.el8_0.1
1:2.2.36-5.el8_0.1
dovecot-pgsql
Red Hat:enterprise_linux:8::appstream
 before 1:2.2.36-5.el8_0.1
1:2.2.36-5.el8_0.1
dovecot-pgsql-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 1:2.2.36-5.el8_0.1
1:2.2.36-5.el8_0.1
dovecot-pigeonhole-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 1:2.2.36-5.el8_0.1
1:2.2.36-5.el8_0.1
dovecot
Red Hat:enterprise_linux:8::crb
 before 1:2.2.36-5.el8_0.1
1:2.2.36-5.el8_0.1
dovecot-debuginfo
Red Hat:enterprise_linux:8::crb
 before 1:2.2.36-5.el8_0.1
1:2.2.36-5.el8_0.1
dovecot-debugsource
Red Hat:enterprise_linux:8::crb
 before 1:2.2.36-5.el8_0.1
1:2.2.36-5.el8_0.1
dovecot-devel
Red Hat:enterprise_linux:8::crb
 before 1:2.2.36-5.el8_0.1
1:2.2.36-5.el8_0.1
dovecot-mysql-debuginfo
Red Hat:enterprise_linux:8::crb
 before 1:2.2.36-5.el8_0.1
1:2.2.36-5.el8_0.1
dovecot-pgsql-debuginfo
Red Hat:enterprise_linux:8::crb
 before 1:2.2.36-5.el8_0.1
1:2.2.36-5.el8_0.1
dovecot-pigeonhole-debuginfo
Red Hat:enterprise_linux:8::crb
 before 1:2.2.36-5.el8_0.1
1:2.2.36-5.el8_0.1
dovecot
Red Hat:enterprise_linux:7::server
 before 1:2.2.36-3.el7_7.1
1:2.2.36-3.el7_7.1
dovecot-debuginfo
Red Hat:enterprise_linux:7::server
 before 1:2.2.36-3.el7_7.1
1:2.2.36-3.el7_7.1
dovecot-mysql
Red Hat:enterprise_linux:7::server
 before 1:2.2.36-3.el7_7.1
1:2.2.36-3.el7_7.1
dovecot-pgsql
Red Hat:enterprise_linux:7::server
 before 1:2.2.36-3.el7_7.1
1:2.2.36-3.el7_7.1
dovecot-pigeonhole
Red Hat:enterprise_linux:7::server
 before 1:2.2.36-3.el7_7.1
1:2.2.36-3.el7_7.1
dovecot-devel
Red Hat:enterprise_linux:7::server
 before 1:2.2.36-3.el7_7.1
1:2.2.36-3.el7_7.1
dovecot
Red Hat:enterprise_linux:7::workstation
 before 1:2.2.36-3.el7_7.1
1:2.2.36-3.el7_7.1
dovecot-debuginfo
Red Hat:enterprise_linux:7::workstation
 before 1:2.2.36-3.el7_7.1
1:2.2.36-3.el7_7.1
dovecot-mysql
Red Hat:enterprise_linux:7::workstation
 before 1:2.2.36-3.el7_7.1
1:2.2.36-3.el7_7.1
dovecot-pgsql
Red Hat:enterprise_linux:7::workstation
 before 1:2.2.36-3.el7_7.1
1:2.2.36-3.el7_7.1
dovecot-pigeonhole
Red Hat:enterprise_linux:7::workstation
 before 1:2.2.36-3.el7_7.1
1:2.2.36-3.el7_7.1
dovecot-devel
Red Hat:enterprise_linux:7::workstation
 before 1:2.2.36-3.el7_7.1
1:2.2.36-3.el7_7.1
dovecot
Red Hat:enterprise_linux:6::server
 before 1:2.0.9-22.el6_10.1
1:2.0.9-22.el6_10.1
dovecot-debuginfo
Red Hat:enterprise_linux:6::server
 before 1:2.0.9-22.el6_10.1
1:2.0.9-22.el6_10.1
dovecot-mysql
Red Hat:enterprise_linux:6::server
 before 1:2.0.9-22.el6_10.1
1:2.0.9-22.el6_10.1
dovecot-pgsql
Red Hat:enterprise_linux:6::server
 before 1:2.0.9-22.el6_10.1
1:2.0.9-22.el6_10.1
dovecot-pigeonhole
Red Hat:enterprise_linux:6::server
 before 1:2.0.9-22.el6_10.1
1:2.0.9-22.el6_10.1
dovecot-devel
Red Hat:enterprise_linux:6::server
 before 1:2.0.9-22.el6_10.1
1:2.0.9-22.el6_10.1
dovecot
Red Hat:enterprise_linux:6::workstation
 before 1:2.0.9-22.el6_10.1
1:2.0.9-22.el6_10.1
dovecot-debuginfo
Red Hat:enterprise_linux:6::workstation
 before 1:2.0.9-22.el6_10.1
1:2.0.9-22.el6_10.1
dovecot-mysql
Red Hat:enterprise_linux:6::workstation
 before 1:2.0.9-22.el6_10.1
1:2.0.9-22.el6_10.1
dovecot-pgsql
Red Hat:enterprise_linux:6::workstation
 before 1:2.0.9-22.el6_10.1
1:2.0.9-22.el6_10.1
dovecot-pigeonhole
Red Hat:enterprise_linux:6::workstation
 before 1:2.0.9-22.el6_10.1
1:2.0.9-22.el6_10.1
dovecot-devel
Red Hat:enterprise_linux:6::workstation
 before 1:2.0.9-22.el6_10.1
1:2.0.9-22.el6_10.1
dovecot22
SUSE:HPE Helion OpenStack 8
 before 2.2.31-19.17.1
2.2.31-19.17.1
dovecot22
SUSE:OpenStack Cloud 7
 before 2.2.31-19.17.1
2.2.31-19.17.1
dovecot22
SUSE:OpenStack Cloud 8
 before 2.2.31-19.17.1
2.2.31-19.17.1
dovecot22
SUSE:OpenStack Cloud Crowbar 8
 before 2.2.31-19.17.1
2.2.31-19.17.1
dovecot22
SUSE:Linux Enterprise Server for SAP Applications 12 SP1
 before 2.2.31-19.17.1
2.2.31-19.17.1
dovecot22
SUSE:Linux Enterprise Server for SAP Applications 12 SP2
 before 2.2.31-19.17.1
2.2.31-19.17.1
dovecot22
SUSE:Linux Enterprise Server for SAP Applications 12 SP3
 before 2.2.31-19.17.1
2.2.31-19.17.1
dovecot22
SUSE:Linux Enterprise Software Development Kit 12 SP4
 before 2.2.31-19.17.1
2.2.31-19.17.1
dovecot22
SUSE:Linux Enterprise Software Development Kit 12 SP5
 before 2.2.31-19.17.1
2.2.31-19.17.1
dovecot22
SUSE:Linux Enterprise Server 12 SP1-LTSS
 before 2.2.31-19.17.1
2.2.31-19.17.1
dovecot22
SUSE:Linux Enterprise Server 12 SP2-LTSS
 before 2.2.31-19.17.1
2.2.31-19.17.1
dovecot22
SUSE:Linux Enterprise Server 12 SP2-BCL
 before 2.2.31-19.17.1
2.2.31-19.17.1
dovecot22
SUSE:Linux Enterprise Server 12 SP3-LTSS
 before 2.2.31-19.17.1
2.2.31-19.17.1
dovecot22
SUSE:Linux Enterprise Server 12 SP3-BCL
 before 2.2.31-19.17.1
2.2.31-19.17.1
dovecot22
SUSE:Linux Enterprise Server 12 SP4
 before 2.2.31-19.17.1
2.2.31-19.17.1
dovecot22
SUSE:Linux Enterprise Server for SAP Applications 12 SP4
 before 2.2.31-19.17.1
2.2.31-19.17.1
dovecot22
SUSE:Linux Enterprise Server 12 SP5
 before 2.2.31-19.17.1
2.2.31-19.17.1
dovecot22
SUSE:Linux Enterprise Server for SAP Applications 12 SP5
 before 2.2.31-19.17.1
2.2.31-19.17.1
dovecot22
SUSE:Enterprise Storage 4
 before 2.2.31-19.17.1
2.2.31-19.17.1
dovecot22
SUSE:Enterprise Storage 5
 before 2.2.31-19.17.1
2.2.31-19.17.1
dovecot23
SUSE:Linux Enterprise Module for Server Applications 15 SP1
From an advisory covering 3 CVEs
 before 2.3.3-8.1
2.3.3-8.1
dovecot
Ubuntu:Pro:14.04:LTS
 before 1:2.2.9-1ubuntu2.6+esm1, plus listed versions
1:2.1.7-7ubuntu31:2.2.9-1ubuntu11:2.2.9-1ubuntu21:2.2.9-1ubuntu2.11:2.2.9-1ubuntu2.31:2.2.9-1ubuntu2.41:2.2.9-1ubuntu2.51:2.2.9-1ubuntu2.6
1:2.2.9-1ubuntu2.6+esm1
dovecot
Ubuntu:16.04:LTS
 before 1:2.2.22-1ubuntu2.11, plus listed versions
1:2.2.18-2ubuntu21:2.2.22-1ubuntu11:2.2.22-1ubuntu21:2.2.22-1ubuntu2.11:2.2.22-1ubuntu2.2
Show 7 moreShow less
1:2.2.22-1ubuntu2.31:2.2.22-1ubuntu2.41:2.2.22-1ubuntu2.61:2.2.22-1ubuntu2.71:2.2.22-1ubuntu2.81:2.2.22-1ubuntu2.91:2.2.22-1ubuntu2.10
1:2.2.22-1ubuntu2.11
dovecot
Ubuntu:18.04:LTS
 before 1:2.2.33.2-1ubuntu4.4, plus listed versions
1:2.2.27-3ubuntu11:2.2.33.2-1ubuntu11:2.2.33.2-1ubuntu21:2.2.33.2-1ubuntu31:2.2.33.2-1ubuntu41:2.2.33.2-1ubuntu4.11:2.2.33.2-1ubuntu4.21:2.2.33.2-1ubuntu4.3
1:2.2.33.2-1ubuntu4.4
dovecot
Ubuntu:16.04:LTS
 before 1:2.2.22-1ubuntu2.12, plus listed versions
1:2.2.18-2ubuntu21:2.2.22-1ubuntu11:2.2.22-1ubuntu21:2.2.22-1ubuntu2.11:2.2.22-1ubuntu2.2
Show 8 moreShow less
1:2.2.22-1ubuntu2.31:2.2.22-1ubuntu2.41:2.2.22-1ubuntu2.61:2.2.22-1ubuntu2.71:2.2.22-1ubuntu2.81:2.2.22-1ubuntu2.91:2.2.22-1ubuntu2.101:2.2.22-1ubuntu2.11
1:2.2.22-1ubuntu2.12
dovecot
Ubuntu:18.04:LTS
 before 1:2.2.33.2-1ubuntu4.5, plus listed versions
1:2.2.27-3ubuntu11:2.2.33.2-1ubuntu11:2.2.33.2-1ubuntu21:2.2.33.2-1ubuntu31:2.2.33.2-1ubuntu4
Show 4 moreShow less
1:2.2.33.2-1ubuntu4.11:2.2.33.2-1ubuntu4.21:2.2.33.2-1ubuntu4.31:2.2.33.2-1ubuntu4.4
1:2.2.33.2-1ubuntu4.5
dovecot
Ubuntu:Pro:14.04:LTS
 before 1:2.2.9-1ubuntu2.6+esm2, plus listed versions
1:2.1.7-7ubuntu31:2.2.9-1ubuntu11:2.2.9-1ubuntu21:2.2.9-1ubuntu2.11:2.2.9-1ubuntu2.3
Show 4 moreShow less
1:2.2.9-1ubuntu2.41:2.2.9-1ubuntu2.51:2.2.9-1ubuntu2.61:2.2.9-1ubuntu2.6+esm1
1:2.2.9-1ubuntu2.6+esm2
dovecot23
openSUSE:Leap 15.0
From an advisory covering 3 CVEs
 before 2.3.3-lp150.14.1
2.3.3-lp150.14.1
dovecot23
openSUSE:Leap 15.1
From an advisory covering 3 CVEs
 before 2.3.3-lp151.2.6.1
2.3.3-lp151.2.6.1
dovecot23
openSUSE:Tumbleweed
From an advisory covering 22 CVEs
 before 2.3.16-1.6
2.3.16-1.6
dovecot24
openSUSE:Tumbleweed
From an advisory covering 24 CVEs
 before 2.4.0-1.1
2.4.0-1.1

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2019-11500 is a critical vulnerability (CVSS 9.8) in Dovecot, published August 28, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 62.3%, the 99th percentile. Fixed in dovecot 2.3.7.2-r0.

References

Show 59 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open