Dovecot: >> Dovecot >> 2.3 Security Vulnerabilities
In Dovecot before 2.3.10.1, a crafted SMTP/LMTP message triggers an unauthenticated use-after-free bug in submission-login, submission, or lmtp, and can lead to a crash under circumstances involving many newlines after a command.
CVSS Score
5.3
EPSS Score
0.01
Published
2020-05-18
In Dovecot before 2.3.9.2, an attacker can crash a push-notification driver with a crafted email when push notifications are used, because of a NULL Pointer Dereference. The email must use a group address as either the sender or the recipient.
CVSS Score
5.3
EPSS Score
0.012
Published
2019-12-13
The JSON encoder in Dovecot before 2.3.5.2 allows attackers to repeatedly crash the authentication service by attempting to authenticate with an invalid UTF-8 sequence as the username.
CVSS Score
7.5
EPSS Score
0.008
Published
2019-04-24
Page 2