dovecot vulnerabilities (Red Hat)
41 vulnerabilities.
-
dovecotRed Hat An attacker that holds a token intended for a different purpose can authenticate, because when an... 7.4 High -
dovecotRed Hat An unauthenticated attacker can send an IMAP ID command with a very large number of parameters... 7.5 High -
dovecotRed Hat An attacker that has valid credentials can use a Sieve script with the editheader extension to... 9.1 Critical -
dovecotRed Hat An unauthenticated attacker can send a truncated quoted argument to the ManageSieve login process... 5.9 Medium -
dovecotRed Hat None None None No publicly available exploits are known. 7.4 High -
dovecotRed Hat An unauthenticated attacker can crash the ManageSieve login process by sending a small malformed... 7.5 High -
dovecotRed Hat When mail_max_userip_connections is set (default 10) and reached, submission-login can crash with... 4.3 Medium -
dovecotRed Hat An attacker that can send mail to a user can craft a message whose headers contain a very large... 7.5 High -
dovecotRed Hat An attacker can cause uncontrolled memory usage with excessive bracing over IMAP. The fix in CVE... 4.3 Medium -
dovecotRed Hat Attacker can send a specifically crafted message before authentication that causes managesieve to... 7.5 High -
dovecotRed Hat Sending "NOOP (((...)))" command with 4000 parenthesis open+close results in ~1MB extra memory... 4.3 Medium -
dovecotRed Hat Doveadm credentials are verified using direct comparison which is susceptible to timing oracle... 7.4 High -
dovecotRed Hat ManageSieve AUTHENTICATE command crashes when using literal as SASL initial response. This can be... 7.5 High -
dovecotRed Hat Very large headers can cause resource exhaustion when parsing message. The message-parser... 7.5 High -
dovecotRed Hat Having a large number of address headers (From, To, Cc, Bcc, etc.) becomes excessively CPU... 5.0 Medium -
dovecotRed Hat An issue was discovered in the auth component in Dovecot 2.2 and 2.3 before 2.3.20. When two... 8.8 High -
dovecotRed Hat The submission service in Dovecot before 2.3.15 allows STARTTLS command injection in lib-smtp.... 4.8 Medium -
dovecotRed Hat Dovecot before 2.3.13 has Improper Input Validation in lda, lmtp, and imap, leading to an... 7.5 High -
dovecotRed Hat An issue was discovered in Dovecot before 2.3.13. By using IMAP IDLE, an authenticated attacker... 6.8 Medium -
dovecotRed Hat In Dovecot before 2.3.11.3, sending a specially formatted RPA request will crash the auth service... 7.5 High -
dovecotRed Hat In Dovecot before 2.3.11.3, sending a specially formatted NTLM request will crash the auth... 7.5 High -
dovecotRed Hat In Dovecot before 2.3.11.3, uncontrolled recursion in submission, lmtp, and lda allows remote... 7.5 High -
dovecotRed Hat In Dovecot before 2.3.10.1, remote unauthenticated attackers can crash the lmtp or submission... 5.3 Medium -
dovecotRed Hat In Dovecot before 2.3.10.1, a crafted SMTP/LMTP message triggers an unauthenticated use-after... 5.3 Medium -
dovecotRed Hat In Dovecot before 2.3.10.1, unauthenticated sending of malformed parameters to a NOOP command... 7.5 High -
dovecotRed Hat In Dovecot before 2.2.36.4 and 2.3.x before 2.3.7.2 (and Pigeonhole before 0.5.7.2), protocol... 9.8 Critical -
dovecotRed Hat In Dovecot before 2.2.36.3 and 2.3.x before 2.3.5.1, a local attacker can cause a buffer overflow... 8.8 High -
dovecotRed Hat It was discovered that Dovecot before versions 2.2.36.1 and 2.3.4.1 incorrectly handled client... 7.7 High -
dovecotRed Hat Dovecot 1.1 before 2.2.13 and dovecot-ee before 2.1.7.7 and 2.2.x before 2.2.12.12 does not... 5.0 Medium -
dovecotRed Hat Dovecot 2.0.x before 2.0.16, when ssl or starttls is enabled and hostname is used to define the... 5.8 Medium -
dovecotRed Hat script-login in Dovecot 2.0.x before 2.0.13 does not follow the chroot configuration setting,... 6.5 Medium -
dovecotRed Hat script-login in Dovecot 2.0.x before 2.0.13 does not follow the user and group configuration... 6.5 Medium -
dovecotRed Hat lib-mail/message-header-parser.c in Dovecot 1.2.x before 1.2.17 and 2.0.x before 2.0.13 does not... 5.0 Medium -
dovecotRed Hat Dovecot 1.2.x before 1.2.15 allows remote authenticated users to cause a denial of service ... 4.0 Medium -
dovecotRed Hat plugins/acl/acl-backend-vfile.c in Dovecot 1.2.x before 1.2.15 and 2.0.x before 2.0.5 interprets... 5.5 Medium -
dovecotRed Hat dovecot 1.0.7 in Red Hat Enterprise Linux (RHEL) 5, and possibly Fedora, uses world-readable... 2.1 Low -
dovecotRed Hat The ACL plugin in Dovecot before 1.1.4 treats negative access rights as if they are positive... 7.5 High -
dovecotRed Hat Dovecot before 1.0.11, when configured to use mail_extra_groups to allow Dovecot to create... 4.4 Medium -
dovecotRed Hat Dovecot before 1.0.10, with certain configuration options including use of %variables, does not... 6.8 Medium -
dovecotRed Hat The ACL plugin in Dovecot before 1.0.3 allows remote authenticated users with the insert right to... 6.0 Medium -
dovecotRed Hat Directory traversal vulnerability in index/mbox/mbox-storage.c in Dovecot before 1.0.rc29, when... 4.3 Medium