CVE-2020-10958
- State
- Published
- Severity
- 5.3 Medium
- Published
- May 18, 2020
- Updated
- Aug 4, 2024
- Reserved
- Mar 25, 2020
Description
In Dovecot before 2.3.10.1, a crafted SMTP/LMTP message triggers an unauthenticated use-after-free bug in submission-login, submission, or lmtp, and can lead to a crash under circumstances involving many newlines after a command.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.0 | 5.3 Medium | CVSS:3.0/AC:L/AV:N/A:L/C:N/I:N/PR:N/S:U/UI:N | mitre |
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
n/an/a |
|
References
- https://dovecot.org/security
- https://www.openwall.com/lists/oss-security/2020/05/18/1
- [oss-security] 20200518 Multiple vulnerabilities in Dovecot IMAP servermailing-list
- USN-4361-1vendor-advisory
- 20200519 Multiple vulnerabilities in Dovecot IMAP servermailing-list
- http://packetstormsecurity.com/files/157771/Open-Xchange-Dovecot-2.3.10-Null-Pointer-Dereference-Denial-Of-Service.html
- DSA-4690vendor-advisory
- FEDORA-2020-1dee17d880vendor-advisory
- openSUSE-SU-2020:0720vendor-advisory
- FEDORA-2020-b60344c987vendor-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.