CVE-2017-14461
Fixed in a distro release EPSS 17%CVSS 5.9
A specially crafted email delivered over SMTP and passed on to Dovecot by MTA can trigger an out of bounds read resulting in potential sensitive information disclosure and denial of service. In order to trigger this vulnerability, an attacker needs to send a specially crafted email message to the server.
Products: The Dovecot Project Dovecot
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Alpine:v3.10 | dovecot | 2.3.1-r0 |
| Alpine:v3.11 | dovecot | 2.3.1-r0 |
| Alpine:v3.12 | dovecot | 2.3.1-r0 |
| Alpine:v3.13 | dovecot | 2.3.1-r0 |
| Alpine:v3.14 | dovecot | 2.3.1-r0 |
| Alpine:v3.15 | dovecot | 2.3.1-r0 |
| Alpine:v3.16 | dovecot | 2.3.1-r0 |
| Alpine:v3.17 | dovecot | 2.3.1-r0 |
| Alpine:v3.18 | dovecot | 2.3.1-r0 |
| Alpine:v3.19 | dovecot | 2.3.1-r0 |
| Alpine:v3.20 | dovecot | 2.3.1-r0 |
| Alpine:v3.21 | dovecot | 2.3.1-r0 |
| Alpine:v3.22 | dovecot | 2.3.1-r0 |
| Alpine:v3.23 | dovecot | 2.3.1-r0 |
| Alpine:v3.24 | dovecot | 2.3.1-r0 |
| Alpine:v3.7 | dovecot | 2.2.34-r0 |
| Alpine:v3.8 | dovecot | 2.3.1-r0 |
| Alpine:v3.9 | dovecot | 2.3.1-r0 |
| Debian:12 | dovecot | 1:2.2.34-1 |
| Debian:13 | dovecot | 1:2.2.34-1 |
| Debian:14 | dovecot | 1:2.2.34-1 |
| Debian:7 | dovecot | 1:2.1.7-7+deb7u2 |
| Debian:8 | dovecot | 1:2.2.13-12~deb8u4 |
| Debian:9 | dovecot | 1:2.2.27-3+deb9u2 |
| SUSE:Linux Enterprise Server 12 SP3 | dovecot22 | 2.2.31-19.8.1 |
| SUSE:Linux Enterprise Server for SAP Applications 12 SP3 | dovecot22 | 2.2.31-19.8.1 |
| SUSE:Linux Enterprise Software Development Kit 12 SP3 | dovecot22 | 2.2.31-19.8.1 |
| Ubuntu:14.04:LTS | dovecot | 1:2.2.9-1ubuntu2.4 |
| Ubuntu:16.04:LTS | dovecot | 1:2.2.22-1ubuntu2.7 |
| openSUSE:Tumbleweed | dovecot23 | 2.3.16-1.6 |
| openSUSE:Tumbleweed | dovecot24 | 2.4.0-1.1 |