From d0c0209b7790d0efa77d0574ab92397fc604b83c Mon Sep 17 00:00:00 2001 From: Larry Rosenman Date: Fri, 14 Aug 2020 00:14:16 +0000 Subject: [PATCH] security/vuxml: mail/dovecot multiple vulnerabilities. --- security/vuxml/vuln.xml | 45 +++++++++++++++++++++++++++++++++++++++++ 1 file changed, 45 insertions(+) diff --git a/security/vuxml/vuln.xml b/security/vuxml/vuln.xml index 427a3e5f62a1..d77e0b45fd64 100644 --- a/security/vuxml/vuln.xml +++ b/security/vuxml/vuln.xml @@ -58,6 +58,51 @@ Notes: * Do not forget port variants (linux-f10-libxml2, libxml2, etc.) --> + + mail/dovecot -- multiple vulnerabilities + + + dovecot + 2.3.11 + + + + +

Aki Tuomi reports:

+
+

Parsing mails with a large number of MIME parts could + have resulted in excessive CPU usage or a crash due to running out of + stack memory..

+
+
+

Dovecot's NTLM implementation does not correctly check + message buffer size, which leads to reading past allocation which can + lead to crash

+
+
+

lmtp/submission: Issuing the RCPT command with an + address that has the empty quoted string as local-part causes the lmtp + service to crash.

+
+
+

Dovecot's RPA mechanism implementation accepts + zero-length message, which leads to assert-crash later on.

+
+ + + + https://dovecot.org/pipermail/dovecot-news/2020-August/000440.html + CVE-2020-12100 + CVE-2020-12673 + CVE-2020-10967 + CVE-2020-12674 + + + 2020-04-23 + 2020-08-13 + + + ilmbase, openexr -- v2.5.3 is a patch release with various bug/security fixes