{"id":"CVE-2017-14461","aliases":["ALPINE-CVE-2017-14461","CLSA-2026-1781102465","DEBIAN-CVE-2017-14461","DLA-1333-1","DSA-4130-1","EUVD-2017-5964","GHSA-r34f-p748-2x25","MGASA-2018-0160","SUSE-SU-2018:1125-1","UBUNTU-CVE-2017-14461","USN-3587-1","openSUSE-SU-2024:10726-1","openSUSE-SU-2025:14715-1"],"status":"published","title":"A specially crafted email delivered over SMTP and passed on to Dovecot by MTA can trigger an out...","description":"A specially crafted email delivered over SMTP and passed on to Dovecot by MTA can trigger an out of bounds read resulting in potential sensitive information disclosure and denial of service. In order to trigger this vulnerability, an attacker needs to send a specially crafted email message to the server.","severity":{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:H","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-08","score":0.16677,"percentile":0.97044,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-125","CWE-200"],"published":"2018-02-28T00:00:00Z","modified":"2026-10-26T09:31:39Z","fixes":[{"ecosystem":"Alpine:v3.10","package":"dovecot","fixed_in":["2.3.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.11","package":"dovecot","fixed_in":["2.3.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"dovecot","fixed_in":["2.3.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"dovecot","fixed_in":["2.3.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"dovecot","fixed_in":["2.3.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"dovecot","fixed_in":["2.3.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"dovecot","fixed_in":["2.3.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"dovecot","fixed_in":["2.3.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"dovecot","fixed_in":["2.3.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"dovecot","fixed_in":["2.3.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"dovecot","fixed_in":["2.3.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"dovecot","fixed_in":["2.3.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"dovecot","fixed_in":["2.3.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"dovecot","fixed_in":["2.3.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"dovecot","fixed_in":["2.3.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.7","package":"dovecot","fixed_in":["2.2.34-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.8","package":"dovecot","fixed_in":["2.3.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.9","package":"dovecot","fixed_in":["2.3.1-r0"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:6","package":"dovecot","fixed_in":["1:2.0.9-23.el6.tuxcare.els6"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:6","package":"dovecot-devel","fixed_in":["1:2.0.9-23.el6.tuxcare.els6"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:6","package":"dovecot-mysql","fixed_in":["1:2.0.9-23.el6.tuxcare.els6"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:6","package":"dovecot-pgsql","fixed_in":["1:2.0.9-23.el6.tuxcare.els6"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:6","package":"dovecot-pigeonhole","fixed_in":["1:2.0.9-23.el6.tuxcare.els6"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"dovecot","fixed_in":["1:2.2.34-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"dovecot","fixed_in":["1:2.2.34-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"dovecot","fixed_in":["1:2.2.34-1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP3","package":"dovecot22","fixed_in":["2.2.31-19.8.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"dovecot22","fixed_in":["2.2.31-19.8.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"dovecot22","fixed_in":["2.2.31-19.8.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"dovecot","fixed_in":["1:2.2.9-1ubuntu2.4"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"dovecot","fixed_in":["1:2.2.22-1ubuntu2.7"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.10","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.11","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.7","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.34-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.8","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.9","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.1-r0"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.0.9-23.el6.tuxcare.els6"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"dovecot-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.0.9-23.el6.tuxcare.els6"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"dovecot-mysql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.0.9-23.el6.tuxcare.els6"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"dovecot-pgsql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.0.9-23.el6.tuxcare.els6"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"dovecot-pigeonhole","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.0.9-23.el6.tuxcare.els6"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.2.34-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.2.34-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.2.34-1"}]}]},{"source":"osv","ecosystem":"Debian:7","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.1.7-7+deb7u2"}]}],"versions":["1:2.1.7-7","1:2.1.7-7+deb7u1"],"bundled":3},{"source":"osv","ecosystem":"Debian:8","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.2.13-12~deb8u4"}]}],"versions":["1:2.2.13-11","1:2.2.13-12~deb8u1","1:2.2.13-12~deb8u2","1:2.2.13-12~deb8u3"],"bundled":3},{"source":"osv","ecosystem":"Debian:9","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.2.27-3+deb9u2"}]}],"versions":["1:2.2.27-3","1:2.2.27-3+deb9u1","1:2.2.27-3+deb9u2~bpo8+1"],"bundled":3},{"source":"osv","ecosystem":"Mageia:6","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.34-1.mga6"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP3","package":"dovecot22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.31-19.8.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"dovecot22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.31-19.8.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"dovecot22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.31-19.8.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.2.9-1ubuntu2.4"}]}],"versions":["1:2.1.7-7ubuntu3","1:2.2.9-1ubuntu1","1:2.2.9-1ubuntu2","1:2.2.9-1ubuntu2.1","1:2.2.9-1ubuntu2.3"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.2.22-1ubuntu2.7"}]}],"versions":["1:2.2.18-2ubuntu2","1:2.2.22-1ubuntu1","1:2.2.22-1ubuntu2","1:2.2.22-1ubuntu2.1","1:2.2.22-1ubuntu2.2","1:2.2.22-1ubuntu2.3","1:2.2.22-1ubuntu2.4","1:2.2.22-1ubuntu2.6"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.2.9-1ubuntu2.4"}]}],"versions":["1:2.1.7-7ubuntu3","1:2.2.9-1ubuntu1","1:2.2.9-1ubuntu2","1:2.2.9-1ubuntu2.1","1:2.2.9-1ubuntu2.3"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.2.22-1ubuntu2.7"}]}],"versions":["1:2.2.18-2ubuntu2","1:2.2.22-1ubuntu1","1:2.2.22-1ubuntu2","1:2.2.22-1ubuntu2.1","1:2.2.22-1ubuntu2.2","1:2.2.22-1ubuntu2.3","1:2.2.22-1ubuntu2.4","1:2.2.22-1ubuntu2.6"],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"dovecot23","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.16-1.6"}]}],"bundled":22},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"dovecot24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0-1.1"}]}],"bundled":24}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"dovecot","product":"dovecot"},{"vendor":"the dovecot project","product":"dovecot"},{"vendor":"ubuntu","product":"ubuntu"}],"references":[{"url":"https://usn.ubuntu.com/3587-1/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Patch","Third Party Advisory","fix"]},{"url":"https://lists.debian.org/debian-lts-announce/2018/03/msg00036.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://www.debian.org/security/2018/dsa-4130","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory"]},{"url":"https://usn.ubuntu.com/3587-2/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","web"]},{"url":"http://www.securityfocus.com/bid/103201","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://www.dovecot.org/list/dovecot-news/2018-February/000370.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Issue Tracking","Vendor Advisory","report"]},{"url":"https://talosintelligence.com/vulnerability_reports/TALOS-2017-0510","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-14461","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-r34f-p748-2x25"},{"url":"https://security.alpinelinux.org/vuln/CVE-2017-14461","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos6els/CLSA-2026-1781102465.html","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2017-14461","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2018-0160.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=22673","tags":["report"]},{"url":"http://openwall.com/lists/oss-security/2018/03/01/2","tags":["web"]},{"url":"http://openwall.com/lists/oss-security/2018/03/01/3","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20181125-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1082826","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2017-14461","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2017-14461","tags":["report"]},{"url":"http://www.openwall.com/lists/oss-security/2018/03/01/2","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-3587-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-3587-2","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-14461","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-15130","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2017-15130","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-15132","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-10691","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11494","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11499","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11500","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-19722","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-3814","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-7524","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-10957","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-10958","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-10967","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-12100","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-12673","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-12674","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-24386","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-28200","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-7046","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-7957","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-29157","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-33515","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/KZSDCZ5LA6IHY7KXVSL6ULAJVP6OFT2M/","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2024-23184","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-23185","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2017-14461","description":"A specially crafted email delivered over SMTP and passed on to Dovecot by MTA can trigger an out of bounds read resulting in potential sensitive information disclosure and denial of service. In order to trigger this vulnerability, an attacker needs to send a specially crafted email message to the server.","status":"published","published":"2018-03-02T15:00:00Z","modified":"2024-09-16T23:00:46.355Z","cvss":[{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:33:11.928814Z"}],"euvd":[{"id":"EUVD-2017-5964","description":"A specially crafted email delivered over SMTP and passed on to Dovecot by MTA can trigger an out of bounds read resulting in potential sensitive information disclosure and denial of service. In order to trigger this vulnerability, an attacker needs to send a specially crafted email message to the server.","status":"published","published":"2018-03-02T15:00:00Z","modified":"2024-09-16T23:00:46Z","cvss":[{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:H","level":"medium"}],"updated_at":"2026-11-03T00:54:57.7565Z"}],"ghsa":[{"id":"GHSA-r34f-p748-2x25","title":"A specially crafted email delivered over SMTP and passed on to Dovecot by MTA can trigger an out...","description":"A specially crafted email delivered over SMTP and passed on to Dovecot by MTA can trigger an out of bounds read resulting in potential sensitive information disclosure and denial of service. In order to trigger this vulnerability, an attacker needs to send a specially crafted email message to the server.","status":"published","published":"2022-05-13T01:01:33Z","modified":"2023-02-01T05:02:26Z","cvss":[{"version":"3.0","score":7.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H","level":"high"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:49:54.32219Z"}],"nvd":[{"id":"CVE-2017-14461","description":"A specially crafted email delivered over SMTP and passed on to Dovecot by MTA can trigger an out of bounds read resulting in potential sensitive information disclosure and denial of service. In order to trigger this vulnerability, an attacker needs to send a specially crafted email message to the server.","status":"published","published":"2018-03-02T15:29:00.21Z","modified":"2026-06-17T01:06:11.44Z","cvss":[{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:H","level":"medium","assessor":"secondary"},{"version":"3.0","score":7.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5.5,"vector":"AV:N/AC:L/Au:S/C:P/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-125","CWE-200"],"updated_at":"2026-11-02T14:04:15.877386Z"}],"osv":[{"id":"ALPINE-CVE-2017-14461","description":"A specially crafted email delivered over SMTP and passed on to Dovecot by MTA can trigger an out of bounds read resulting in potential sensitive information disclosure and denial of service. In order to trigger this vulnerability, an attacker needs to send a specially crafted email message to the server.","status":"published","published":"2018-03-02T15:29:00.21Z","modified":"2026-06-15T18:18:06.772159117Z","cvss":[{"version":"3.0","score":7.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:27:46.716249Z"},{"id":"CVE-2017-14461","description":"A specially crafted email delivered over SMTP and passed on to Dovecot by MTA can trigger an out of bounds read resulting in potential sensitive information disclosure and denial of service. In order to trigger this vulnerability, an attacker needs to send a specially crafted email message to the server.","status":"published","published":"2018-03-02T15:29:00.21Z","modified":"2026-10-24T10:30:25.526832839Z","cvss":[{"version":"3.0","score":7.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:04.572713Z"},{"id":"DEBIAN-CVE-2017-14461","description":"A specially crafted email delivered over SMTP and passed on to Dovecot by MTA can trigger an out of bounds read resulting in potential sensitive information disclosure and denial of service. In order to trigger this vulnerability, an attacker needs to send a specially crafted email message to the server.","status":"published","published":"2018-03-02T15:29:00.21Z","modified":"2026-09-01T20:03:43.951461703Z","cvss":[{"version":"3.0","score":7.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:28.801885Z"},{"id":"UBUNTU-CVE-2017-14461","description":"A specially crafted email delivered over SMTP and passed on to Dovecot by MTA can trigger an out of bounds read resulting in potential sensitive information disclosure and denial of service. In order to trigger this vulnerability, an attacker needs to send a specially crafted email message to the server.","status":"published","published":"2018-02-28T00:00:00Z","modified":"2026-04-22T11:16:38.07547Z","cvss":[{"version":"3.0","score":7.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H","level":"high"},{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:54:14.122973Z"},{"id":"CLSA-2026-1781102465","title":"dovecot: Fix of CVE-2017-14461","description":"- CVE-2017-14461: lib-mail: fix out-of-bounds read when parsing an invalid email address in parse_addr_spec()","status":"published","published":"2026-06-11T19:58:16Z","modified":"2026-10-26T09:31:39.306517357Z","updated_at":"2026-11-02T15:43:45.445699Z"},{"id":"DLA-1333-1","title":"dovecot - security update","status":"published","published":"2018-03-31T00:00:00Z","modified":"2026-03-09T01:01:08.98492Z","updated_at":"2026-11-02T15:46:09.336894Z"},{"id":"DSA-4130-1","title":"dovecot - security update","status":"published","published":"2018-03-02T00:00:00Z","modified":"2026-03-09T01:19:52.400799Z","updated_at":"2026-11-02T15:46:16.862196Z"},{"id":"MGASA-2018-0160","title":"Updated dovecot packages fix security vulnerabilities","description":"Dovecot has been updated to version 2.2.34 to fix two security issues.\n\nCVE-2017-14461:\nThis vulnerability comes in two flavors. A malicious party can send a\nspecially crafted email to a vulnerable system, causing it to crash\ndovecot. In some systems, the mail can be stored into the mail system, \ncausing crash every time it is being opened.\n\nCVE-2017-15130:\nIf dovecot has been configured with local name or local net\nconfiguration blocks, SNI lookups can be used to trash memory with\nuseless config by using random servernames.\n","status":"published","published":"2018-03-07T20:37:26Z","modified":"2026-04-16T06:24:10.127629991Z","updated_at":"2026-11-02T15:49:40.442238Z"},{"id":"openSUSE-SU-2024:10726-1","title":"dovecot23-2.3.16-1.6 on GA media","description":"These are all security issues fixed in the dovecot23-2.3.16-1.6 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2025-05-07T18:09:35.541917Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"openSUSE-SU-2025:14715-1","title":"dovecot24-2.4.0-1.1 on GA media","description":"These are all security issues fixed in the dovecot24-2.4.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-01-30T00:00:00Z","modified":"2026-02-04T03:33:59.818366Z","updated_at":"2026-11-02T16:58:36.976155Z"},{"id":"SUSE-SU-2018:1125-1","title":"Security update for dovecot22","description":"This update for dovecot22 fixes the following issues:\n\n- CVE-2017-14461: dovecot22: rfc822_parse_domain (bsc#1082826)\n  Information Leak Vulnerability  \n\n","status":"published","published":"2018-05-02T08:29:46Z","modified":"2026-02-04T03:50:06.706511Z","updated_at":"2026-11-02T15:53:44.594517Z"},{"id":"USN-3587-1","title":"dovecot vulnerabilities","description":"It was discovered that Dovecot incorrectly handled parsing certain email\naddresses. A remote attacker could use this issue to cause Dovecot to\ncrash, resulting in a denial of service, or possibly obtain sensitive\ninformation. (CVE-2017-14461)\n\nIt was discovered that Dovecot incorrectly handled TLS SNI config lookups.\nA remote attacker could possibly use this issue to cause Dovecot to crash,\nresulting in a denial of service. (CVE-2017-15130)\n","status":"published","published":"2018-03-05T12:43:51Z","modified":"2026-04-22T09:43:19.637974Z","updated_at":"2026-11-02T16:58:13.496563Z"}]}}