CVSS: 5.0EPSS: 11%CPEs: 31EXPL: 0CVE-2011-1929 – dovecot: potential crash when parsing header names that contain NUL characters
https://notcve.org/view.php?id=CVE-2011-1929
lib-mail/message-header-parser.c in Dovecot 1.2.x before 1.2.17 and 2.0.x before 2.0.13 does not properly handle '\0' characters in header names, which allows remote attackers to cause a denial of service (daemon crash or mailbox corruption) via a crafted e-mail message. lib-mail/message-header-parser.c en Dovecot v1.2.x antes de v1.2.17 y v2.0.x antes de v2.0.13 no controla correctamente los caracteres '\ 0 ' en los nombres de cabecera, lo que permite a atacantes remotos provocar una denegación de servicio (caída del demonio o la corrupción de buzón) a través de un mensaje de e-mail manipulado. • http://dovecot.org/pipermail/dovecot/2011-May/059085.html http://dovecot.org/pipermail/dovecot/2011-May/059086.html http://hg.dovecot.org/dovecot-1.1/rev/3698dfe0f21c http://lists.fedoraproject.org/pipermail/package-announce/2011-June/061384.html http://lists.fedoraproject.org/pipermail/package-announce/2011-May/060815.html http://lists.fedoraproject.org/pipermail/package-announce/2011-May/060825.html http://openwall.com/lists/oss-security/2011/05/18/4 http://openwall.com/lists/oss-se • CWE-20: Improper Input Validation •
CVSS: 5.0EPSS: 6%CPEs: 11EXPL: 0CVE-2010-0745
https://notcve.org/view.php?id=CVE-2010-0745
Unspecified vulnerability in Dovecot 1.2.x before 1.2.11 allows remote attackers to cause a denial of service (CPU consumption) via long headers in an e-mail message. Vulnerabilidad sin especificar en Dovecot v1.2.x anterior a 1.2.11 permite a atacantes remotos provocar una denegación de servicio (consumo CPU) a través de una larga cabecera en un mensaje de e-mail • http://dovecot.org/list/dovecot-news/2010-March/000152.html http://dovecot.org/pipermail/dovecot/2010-February/047190.html http://lists.opensuse.org/opensuse-security-announce/2010-05/msg00001.html http://marc.info/?l=oss-security&m=127013715227551&w=2 http://security-tracker.debian.org/tracker/CVE-2010-0745 http://www.mandriva.com/security/advisories?name=MDVSA-2010:104 http://www.openwall.com/lists/oss-security/2010/03/10/6 http://www.vupen.com/english/advisories/2010/1107 • CWE-399: Resource Management Errors •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 0CVE-2009-3897
https://notcve.org/view.php?id=CVE-2009-3897
Dovecot 1.2.x before 1.2.8 sets 0777 permissions during creation of certain directories at installation time, which allows local users to access arbitrary user accounts by replacing the auth socket, related to the parent directories of the base_dir directory, and possibly the base_dir directory itself. Dovecot v1.2.x anterior v1.2.8 establece permisos 0777 durante la creación de ciertos directorios en el momento de la instalación, permitiendo a usuarios locales acceder a las cuentas de usuarios por reemplazamiento del socket auth, relacionados con los directorios padre del directorio base_dir, y probablemente con el propio directorio base_dir • http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00007.html http://marc.info/?l=oss-security&m=125871729029145&w=2 http://marc.info/?l=oss-security&m=125881481222441&w=2 http://marc.info/?l=oss-security&m=125900267208712&w=2 http://marc.info/?l=oss-security&m=125900271508796&w=2 http://secunia.com/advisories/37443 http://www.dovecot.org/list/dovecot-news/2009-November/000143.html http://www.mandriva.com/security/advisories? • CWE-732: Incorrect Permission Assignment for Critical Resource •