Unrated
In Dovecot before 2.2.36.4 and 2.3.x before 2.3.7.2 (and Pigeonhole before 0.5.7.2), protocol processing can fail for quoted strings. This occurs beca...
CVE-2019-11500
First seen on SecPulse
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Alpine Linux ALPINE-CVE-2019-11500 dovecot Fixed in: 2.3.7.2-r0
- Debian DEBIAN-CVE-2019-11500 dovecot Fixed in: 1:2.3.7.2-1
Original description The description as published by the source.
In Dovecot before 2.2.36.4 and 2.3.x before 2.3.7.2 (and Pigeonhole before 0.5.7.2), protocol processing can fail for quoted strings. This occurs because '\0' characters are mishandled, and can lead to out-of-bounds writes and remote code execution.
References
- advisory access.redhat.com
- advisory access.redhat.com
- advisory access.redhat.com
- advisory lists.debian.org
- advisory security.gentoo.org
- advisory dovecot.org
- patch dovecot.org
- report openwall.com
- web lists.opensuse.org
- web lists.opensuse.org
- web lists.fedoraproject.org
- web lists.fedoraproject.org
- web lists.fedoraproject.org