CVE-2019-11500

Debian Bug report logs - #936014 dovecot: CVE-2019-11500 Package: src:dovecot; Maintainer for src:dovecot is Dovecot Maintainers <dovecot@packagesdebianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Thu, 29 Aug 2019 05:15:02 UTC Severity: grave Tags: security, upstream Found in versions dovecot/ ...

Synopsis Important: dovecot security update Type/Severity Security Advisory: Important Topic An update for dovecot is now available for Red Hat Enterprise Linux 6Red Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scoring System (CVSS) base score, ...

Synopsis Important: dovecot security update Type/Severity Security Advisory: Important Topic An update for dovecot is now available for Red Hat Enterprise Linux 7Red Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scoring System (CVSS) base score, ...

Synopsis Important: dovecot security update Type/Severity Security Advisory: Important Topic An update for dovecot is now available for Red Hat Enterprise Linux 8Red Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scoring System (CVSS) base score, ...

Nick Roessler and Rafi Rubin discovered that the IMAP and ManageSieve protocol parsers in the Dovecot email server do not properly validate input (both pre- and post-login) A remote attacker can take advantage of this flaw to trigger out of bounds heap memory writes, leading to information leaks or potentially the execution of arbitrary code For ...

Dovecot could be made to crash or execute arbitrary code if it received a specially crafted data ...

USN-4110-1 introduced a regression in Dovecot ...

Dovecot could be made to crash or execute arbitrary code if it received a specially crafted data ...

USN-4110-1 introduced a regression in Dovecot ...

In Dovecot before 22364 and 23x before 2372 (and Pigeonhole before 0572), protocol processing can fail for quoted strings This occurs because '\\0' characters are mishandled, and can lead to out-of-bounds writes and remote code execution(CVE-2019-11500) ...

IMAP and ManageSieve protocol parsers in Dovecot before 2372 and Pigeonhole before 0572 do not properly handle NUL byte when scanning data in quoted strings, leading to out of bounds heap memory writes ...