In Dovecot before 2.2.36.3 and 2.3.x before 2.3.5.1, a local attacker can cause a buffer overflow in the indexer-worker process, which can be used to elevate to root. This occurs because of missing checks in the fts and pop3-uidl components.
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.0 Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | alpine-linux-upgrade-dovecot | Nov 8, 2019 | Mar 28, 2019 | |
| Amazon Linux Ami 2 | amazon-linux-ami-2-upgrade-dovecotamazon-linux-ami-2-upgrade-dovecot-debuginfoamazon-linux-ami-2-upgrade-dovecot-develamazon-linux-ami-2-upgrade-dovecot-mysqlamazon-linux-ami-2-upgrade-dovecot-pgsqlamazon-linux-ami-2-upgrade-dovecot-pigeonhole | Aug 25, 2020 | Mar 28, 2019 | |
| Amazon_linux | — | amazon-linux-upgrade-dovecot | May 15, 2020 | Feb 5, 2019 |
| Arch Linux | arch-linux-upgrade-latest | Jul 11, 2025 | Mar 28, 2019 | |
| Centos_linux | — | centos-upgrade-dovecotcentos-upgrade-dovecot-debuginfocentos-upgrade-dovecot-develcentos-upgrade-dovecot-mysqlcentos-upgrade-dovecot-pgsqlcentos-upgrade-dovecot-pigeonhole | Apr 1, 2020 | Mar 28, 2019 |
| Debian | debian-upgrade-dovecot | Mar 29, 2019 | Mar 28, 2019 | |
| Freebsd | freebsd-upgrade-package-dovecot | Apr 1, 2019 | Mar 28, 2019 | |
| Gentoo Linux | gentoo-linux-upgrade-net-mail-dovecot | Apr 18, 2019 | Mar 28, 2019 | |
| Huawei Euleros 2_0_sp2 | huawei-euleros-2_0_sp2-upgrade-dovecothuawei-euleros-2_0_sp2-upgrade-dovecot-mysqlhuawei-euleros-2_0_sp2-upgrade-dovecot-pgsqlhuawei-euleros-2_0_sp2-upgrade-dovecot-pigeonhole | May 1, 2019 | Mar 28, 2019 | |
| Huawei Euleros 2_0_sp3 | huawei-euleros-2_0_sp3-upgrade-dovecothuawei-euleros-2_0_sp3-upgrade-dovecot-mysqlhuawei-euleros-2_0_sp3-upgrade-dovecot-pgsqlhuawei-euleros-2_0_sp3-upgrade-dovecot-pigeonhole | May 30, 2019 | Mar 28, 2019 | |
| Huawei Euleros 2_0_sp5 | huawei-euleros-2_0_sp5-upgrade-dovecothuawei-euleros-2_0_sp5-upgrade-dovecot-mysqlhuawei-euleros-2_0_sp5-upgrade-dovecot-pgsqlhuawei-euleros-2_0_sp5-upgrade-dovecot-pigeonhole | May 1, 2019 | Mar 28, 2019 | |
| Huawei Euleros 2_0_sp8 | huawei-euleros-2_0_sp8-upgrade-dovecothuawei-euleros-2_0_sp8-upgrade-dovecot-mysqlhuawei-euleros-2_0_sp8-upgrade-dovecot-pigeonhole | Jun 27, 2019 | Mar 28, 2019 | |
| Oracle_linux | — | oracle-linux-upgrade-dovecotoracle-linux-upgrade-dovecot-develoracle-linux-upgrade-dovecot-mysqloracle-linux-upgrade-dovecot-pgsqloracle-linux-upgrade-dovecot-pigeonhole | Oct 5, 2022 | Mar 28, 2019 |
| Redhat_linux | — | redhat-upgrade-dovecotredhat-upgrade-dovecot-debuginforedhat-upgrade-dovecot-develredhat-upgrade-dovecot-mysqlredhat-upgrade-dovecot-pgsqlredhat-upgrade-dovecot-pigeonhole | Apr 1, 2020 | Mar 28, 2019 |
| Suse | — | suse-upgrade-dovecot22suse-upgrade-dovecot22-backend-mysqlsuse-upgrade-dovecot22-backend-pgsqlsuse-upgrade-dovecot22-backend-sqlitesuse-upgrade-dovecot22-develsuse-upgrade-dovecot23suse-upgrade-dovecot23-backend-mysqlsuse-upgrade-dovecot23-backend-pgsqlsuse-upgrade-dovecot23-backend-sqlitesuse-upgrade-dovecot23-develsuse-upgrade-dovecot23-ftssuse-upgrade-dovecot23-fts-lucenesuse-upgrade-dovecot23-fts-solrsuse-upgrade-dovecot23-fts-squat | Apr 10, 2019 | Feb 5, 2019 |
| Ubuntu | ubuntu-upgrade-dovecot-core | Apr 4, 2019 | Feb 5, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub