In Dovecot before 2.3.10.1, a crafted SMTP/LMTP message triggers an unauthenticated use-after-free bug in submission-login, submission, or lmtp, and can lead to a crash under circumstances involving many newlines after a command.
CVSS Details
- CVSS 3.1 Base Score: 5.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | alma-upgrade-dovecotalma-upgrade-dovecot-devel | May 4, 2022 | May 18, 2020 | |
| Alpine Linux | alpine-linux-upgrade-dovecot | Jun 16, 2020 | May 18, 2020 | |
| Arch Linux | arch-linux-upgrade-latest | Jul 11, 2025 | May 18, 2020 | |
| Centos_linux | — | centos-upgrade-dovecotcentos-upgrade-dovecot-debuginfocentos-upgrade-dovecot-debugsourcecentos-upgrade-dovecot-mysqlcentos-upgrade-dovecot-mysql-debuginfocentos-upgrade-dovecot-pgsqlcentos-upgrade-dovecot-pgsql-debuginfocentos-upgrade-dovecot-pigeonholecentos-upgrade-dovecot-pigeonhole-debuginfo | Nov 5, 2020 | May 18, 2020 |
| Debian | debian-upgrade-dovecot | May 22, 2020 | May 18, 2020 | |
| Freebsd | freebsd-upgrade-package-dovecot | May 19, 2020 | May 18, 2020 | |
| Huawei Euleros 2_0_sp8 | huawei-euleros-2_0_sp8-upgrade-dovecothuawei-euleros-2_0_sp8-upgrade-dovecot-mysqlhuawei-euleros-2_0_sp8-upgrade-dovecot-pigeonhole | Aug 31, 2020 | May 18, 2020 | |
| Oracle_linux | — | oracle-linux-upgrade-dovecotoracle-linux-upgrade-dovecot-develoracle-linux-upgrade-dovecot-mysqloracle-linux-upgrade-dovecot-pgsqloracle-linux-upgrade-dovecot-pigeonhole | Nov 12, 2020 | May 18, 2020 |
| Redhat_linux | redhat-upgrade-dovecotredhat-upgrade-dovecot-debuginforedhat-upgrade-dovecot-debugsourceredhat-upgrade-dovecot-develredhat-upgrade-dovecot-mysqlredhat-upgrade-dovecot-mysql-debuginforedhat-upgrade-dovecot-pgsqlredhat-upgrade-dovecot-pgsql-debuginforedhat-upgrade-dovecot-pigeonholeredhat-upgrade-dovecot-pigeonhole-debuginfo | Nov 5, 2020 | May 18, 2020 | |
| Suse | — | suse-upgrade-dovecot23suse-upgrade-dovecot23-backend-mysqlsuse-upgrade-dovecot23-backend-pgsqlsuse-upgrade-dovecot23-backend-sqlitesuse-upgrade-dovecot23-develsuse-upgrade-dovecot23-ftssuse-upgrade-dovecot23-fts-lucenesuse-upgrade-dovecot23-fts-solrsuse-upgrade-dovecot23-fts-squat | May 23, 2020 | May 18, 2020 |
| Ubuntu | ubuntu-upgrade-dovecot-core | May 19, 2020 | May 18, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub