Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2019-11500

In Dovecot before 2.2.36.4 and 2.3.x before 2.3.7.2 (and Pigeonhole before 0.5.7.2), protocol processing can fail for quoted strings. This occurs because '\0' characters are mishandled, and can lead to out-of-bounds writes and remote code execution.

Published

2019-08-29T14:15:11.037

Last Modified

2024-11-21T04:21:12.797

Status

Modified

Source

[email protected]

Severity

CVSSv3.0: 9.8 (CRITICAL)

CVSSv2 Vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

  • Access Vector: NETWORK
  • Access Complexity: LOW
  • Authentication: NONE
  • Confidentiality Impact: PARTIAL
  • Integrity Impact: PARTIAL
  • Availability Impact: PARTIAL
Exploitability Score

10.0

Impact Score

6.4

Weaknesses
  • Type: Primary
    CWE-787
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application dovecot dovecot < 2.2.36.4 Yes
Application dovecot dovecot < 2.3.7.2 Yes
Application dovecot pigeonhole < 0.5.7.2 Yes
Operating System debian debian_linux 8.0 Yes
Operating System fedoraproject fedora 30 Yes
References