In Dovecot before 2.2.36.3 and 2.3.x before 2.3.5.1, a local attacker can cause a buffer overflow in the indexer-worker process, which can be used to elevate to root. This occurs because of missing checks in the fts and pop3-uidl components.
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.0 Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade dovecot | Nov 8, 2019 | Mar 28, 2019 |
| Amazon Linux Ami 2 | — | Upgrade dovecot-develUpgrade dovecot-pgsqlUpgrade dovecot-mysqlUpgrade dovecotUpgrade dovecot-pigeonholeUpgrade dovecot-debuginfo | Aug 25, 2020 | Mar 28, 2019 |
| Amazon_linux | — | Upgrade dovecot | May 15, 2020 | Feb 5, 2019 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Mar 28, 2019 |
| Centos_linux | — | Upgrade dovecot-develUpgrade dovecot-pgsqlUpgrade dovecot-mysqlUpgrade dovecot-pigeonholeUpgrade dovecotUpgrade dovecot-debuginfo | Apr 1, 2020 | Mar 28, 2019 |
| Debian | — | Upgrade dovecot | Mar 29, 2019 | Mar 28, 2019 |
| Freebsd | — | Upgrade dovecot | Apr 1, 2019 | Mar 28, 2019 |
| Gentoo Linux | — | Upgrade net-mail/dovecot. | Apr 18, 2019 | Mar 28, 2019 |
| Huawei Euleros 2_0_sp2 | — | Upgrade dovecot-mysqlUpgrade dovecotUpgrade dovecot-pgsqlUpgrade dovecot-pigeonhole | May 1, 2019 | Mar 28, 2019 |
| Huawei Euleros 2_0_sp3 | — | Upgrade dovecot-mysqlUpgrade dovecot-pgsqlUpgrade dovecotUpgrade dovecot-pigeonhole | May 30, 2019 | Mar 28, 2019 |
| Huawei Euleros 2_0_sp5 | — | Upgrade dovecotUpgrade dovecot-mysqlUpgrade dovecot-pigeonholeUpgrade dovecot-pgsql | May 1, 2019 | Mar 28, 2019 |
| Huawei Euleros 2_0_sp8 | — | Upgrade dovecot-mysqlUpgrade dovecot-pigeonholeUpgrade dovecot | Jun 27, 2019 | Mar 28, 2019 |
| Oracle_linux | — | Upgrade dovecot-pigeonholeUpgrade dovecot-develUpgrade dovecot-mysqlUpgrade dovecot-pgsqlUpgrade dovecot | Oct 5, 2022 | Mar 28, 2019 |
| Redhat_linux | — | Upgrade dovecot-debuginfoUpgrade dovecotUpgrade dovecot-mysqlUpgrade dovecot-pigeonholeNo solution existsUpgrade dovecot-develUpgrade dovecot-pgsql | Apr 1, 2020 | Mar 28, 2019 |
| Suse | — | Upgrade dovecot23-backend-sqliteUpgrade dovecot23-develUpgrade dovecot22-backend-sqliteUpgrade dovecot23-fts-solrUpgrade dovecot23-ftsUpgrade dovecot22-backend-pgsqlUpgrade dovecot22-backend-mysqlUpgrade dovecot23-backend-mysqlUpgrade dovecot22Upgrade dovecot23-fts-squatUpgrade dovecot22-develUpgrade dovecot23-fts-luceneUpgrade dovecot23-backend-pgsqlUpgrade dovecot23 | Apr 10, 2019 | Feb 5, 2019 |
| Ubuntu | — | Upgrade dovecot-core | Apr 4, 2019 | Feb 5, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub