CVE-2020-10958

In Dovecot before 2.3.10.1, a crafted SMTP/LMTP message triggers an unauthenticated use-after-free bug in submission-login, submission, or lmtp, and can lead to a crash under circumstances involving many newlines after a command.

In Dovecot before 2.3.10.1, a crafted SMTP/LMTP message triggers an unauthenticated use-after-free bug in submission-login, submission, or lmtp, and can lead to a crash under circumstances involving many newlines after a command.

Dovecot is an IMAP server for Linux and other UNIX-like systems, written primarily with security in mind. It also contains a small POP3 server, and supports e-mail in either the maildir or mbox format. The SQL drivers and authentication plug-ins are provided as subpackages.

Security Fix(es):

• dovecot: command followed by sufficient number of newlines leads to use-after-free (CVE-2020-10958)

• dovecot: sending mail with empty quoted localpart leads to DoS (CVE-2020-10967)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

Dovecot has been updated to fix several security issues.

Sending malformed NOOP command causes crash in submission, submission-login or lmtp service (CVE-2020-10957).

Sending command followed by sufficient number of newlines triggers a use-after-free bug that might crash submission-login, submission or lmtp service (CVE-2020-10958).

Sending mail with empty quoted localpart causes submission or lmtp component to crash (CVE-2020-10967).

This update for dovecot23 to 2.3.10 fixes the following issues:

Security issues fixed:

• CVE-2020-10957: Fixed a crash caused by malformed NOOP commands (bsc#1171457).
• CVE-2020-10958: Fixed a use-after-free when receiving too many newlines (bsc#1171458).
• CVE-2020-10967: Fixed a crash in the lmtp and submission components caused by mails with empty quoted localparts (bsc#1171456).

Non-security issues fixed:

• The update to 2.3.10 fixes several bugs. Please refer to https://dovecot.org/doc/NEWS for a complete list of changes.

This update was imported from the SUSE:SLE-15-SP1:Update update project.

These are all security issues fixed in the dovecot23-2.3.16-1.6 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the dovecot24-2.4.0-1.1 package on the GA media of openSUSE Tumbleweed.

This update for dovecot23 fixes the following issues:

Security issues fixed:

• CVE-2020-10957: Fixed a crash caused by malformed NOOP commands (bsc#1171457).
• CVE-2020-10958: Fixed a use-after-free when receiving too many newlines (bsc#1171458).
• CVE-2020-10967: Fixed a crash in the lmtp and submission components caused by mails with empty quoted localparts (bsc#1171456).

Non-security issues fixed:

• The update to 2.3.10 fixes several bugs. Please refer to https://dovecot.org/doc/NEWS for a complete list of changes.

This update for dovecot23 to 2.3.10 fixes the following issues:

Security issues fixed:

• CVE-2020-10957: Fixed a crash caused by malformed NOOP commands (bsc#1171457).
• CVE-2020-10958: Fixed a use-after-free when receiving too many newlines (bsc#1171458).
• CVE-2020-10967: Fixed a crash in the lmtp and submission components caused by mails with empty quoted localparts (bsc#1171456).

Non-security issues fixed:

• The update to 2.3.10 fixes several bugs. Please refer to https://dovecot.org/doc/NEWS for a complete list of changes.

Philippe Antoine discovered that Dovecot incorrectly handled certain data. An attacker could possibly use this issue to cause a denial of service. (CVE-2020-10957, CVE-2020-10967)

Philippe Antoine discovered that Dovecot incorrectly handled certain data. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. (CVE-2020-10958)