rhsa-2008_0297
Vulnerability from csaf_redhat
Published
2008-05-20 14:28
Modified
2024-11-22 01:40
Summary
Red Hat Security Advisory: dovecot security and bug fix update

Notes

Topic
An updated dovecot package that fixes several security issues and various bugs is now available for Red Hat Enterprise Linux 5. This update has been rated as having low security impact by the Red Hat Security Response Team.
Details
Dovecot is an IMAP server for Linux and UNIX-like systems, primarily written with security in mind. A flaw was discovered in the way Dovecot handled the "mail_extra_groups" option. An authenticated attacker with local shell access could leverage this flaw to read, modify, or delete other users mail that is stored on the mail server. (CVE-2008-1199) This issue did not affect the default Red Hat Enterprise Linux 5 Dovecot configuration. This update adds two new configuration options -- "mail_privileged_group" and "mail_access_groups" -- to minimize the usage of additional privileges. A directory traversal flaw was discovered in Dovecot's zlib plug-in. An authenticated user could use this flaw to view other compressed mailboxes with the permissions of the Dovecot process. (CVE-2007-2231) A flaw was found in the Dovecot ACL plug-in. User with only insert permissions for a mailbox could use the "COPY" and "APPEND" commands to set additional message flags. (CVE-2007-4211) A flaw was found in a way Dovecot cached LDAP query results in certain configurations. This could possibly allow authenticated users to log in as a different user who has the same password. (CVE-2007-6598) As well, this updated package fixes the following bugs: * configuring "userdb" and "passdb" to use LDAP caused Dovecot to hang. A segmentation fault may have occurred. In this updated package, using an LDAP backend for "userdb" and "passdb" no longer causes Dovecot to hang. * the Dovecot "login_process_size" limit was configured for 32-bit systems. On 64-bit systems, when Dovecot was configured to use either IMAP or POP3, the log in processes crashed with out-of-memory errors. Errors such as the following were logged: pop3-login: pop3-login: error while loading shared libraries: libsepol.so.1: failed to map segment from shared object: Cannot allocate memory In this updated package, the "login_process_size" limit is correctly configured on 64-bit systems, which resolves this issue. Note: this updated package upgrades dovecot to version 1.0.7. For further details, refer to the Dovecot changelog: http://koji.fedoraproject.org/koji/buildinfo?buildID=23397 Users of dovecot are advised to upgrade to this updated package, which resolves these issues.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.


To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Low"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An updated dovecot package that fixes several security issues and various\nbugs is now available for Red Hat Enterprise Linux 5.\n\nThis update has been rated as having low security impact by the Red Hat\nSecurity Response Team.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Dovecot is an IMAP server for Linux and UNIX-like systems, primarily\nwritten with security in mind.\n\nA flaw was discovered in the way Dovecot handled the \"mail_extra_groups\"\noption. An authenticated attacker with local shell access could leverage\nthis flaw to read, modify, or delete other users mail that is stored on\nthe mail server. (CVE-2008-1199)\n\nThis issue did not affect the default Red Hat Enterprise Linux 5 Dovecot\nconfiguration. This update adds two new configuration options --\n\"mail_privileged_group\" and \"mail_access_groups\" -- to minimize the usage\nof additional privileges.\n\nA directory traversal flaw was discovered in Dovecot\u0027s zlib plug-in. An\nauthenticated user could use this flaw to view other compressed mailboxes\nwith the permissions of the Dovecot process. (CVE-2007-2231)\n\nA flaw was found in the Dovecot ACL plug-in. User with only insert\npermissions for a mailbox could use the \"COPY\" and \"APPEND\" commands to set\nadditional message flags. (CVE-2007-4211)\n\nA flaw was found in a way Dovecot cached LDAP query results in certain\nconfigurations. This could possibly allow authenticated users to log in as\na different user who has the same password. (CVE-2007-6598)\n\nAs well, this updated package fixes the following bugs:\n\n* configuring \"userdb\" and \"passdb\" to use LDAP caused Dovecot to hang. A\nsegmentation fault may have occurred. In this updated package, using an\nLDAP backend for \"userdb\" and \"passdb\" no longer causes Dovecot to hang.\n\n* the Dovecot \"login_process_size\" limit was configured for 32-bit systems.\nOn 64-bit systems, when Dovecot was configured to use either IMAP or POP3,\nthe log in processes crashed with out-of-memory errors. Errors such as the\nfollowing were logged:\n\npop3-login: pop3-login: error while loading shared libraries:\nlibsepol.so.1: failed to map segment from shared object: Cannot allocate\nmemory\n\nIn this updated package, the \"login_process_size\" limit is correctly\nconfigured on 64-bit systems, which resolves this issue.\n\nNote: this updated package upgrades dovecot to version 1.0.7. For\nfurther details, refer to the Dovecot changelog:\nhttp://koji.fedoraproject.org/koji/buildinfo?buildID=23397\n\nUsers of dovecot are advised to upgrade to this updated package, which\nresolves these issues.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2008:0297",
        "url": "https://access.redhat.com/errata/RHSA-2008:0297"
      },
      {
        "category": "external",
        "summary": "http://www.redhat.com/security/updates/classification/#low",
        "url": "http://www.redhat.com/security/updates/classification/#low"
      },
      {
        "category": "external",
        "summary": "238439",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=238439"
      },
      {
        "category": "external",
        "summary": "245249",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=245249"
      },
      {
        "category": "external",
        "summary": "251007",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=251007"
      },
      {
        "category": "external",
        "summary": "253363",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=253363"
      },
      {
        "category": "external",
        "summary": "331441",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=331441"
      },
      {
        "category": "external",
        "summary": "380401",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=380401"
      },
      {
        "category": "external",
        "summary": "427575",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=427575"
      },
      {
        "category": "external",
        "summary": "436927",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=436927"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2008/rhsa-2008_0297.json"
      }
    ],
    "title": "Red Hat Security Advisory: dovecot security and bug fix update",
    "tracking": {
      "current_release_date": "2024-11-22T01:40:32+00:00",
      "generator": {
        "date": "2024-11-22T01:40:32+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.2.1"
        }
      },
      "id": "RHSA-2008:0297",
      "initial_release_date": "2008-05-20T14:28:00+00:00",
      "revision_history": [
        {
          "date": "2008-05-20T14:28:00+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2008-05-21T10:20:08+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-11-22T01:40:32+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux Desktop Workstation (v. 5 client)",
                "product": {
                  "name": "Red Hat Enterprise Linux Desktop Workstation (v. 5 client)",
                  "product_id": "5Client-Workstation",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:enterprise_linux:5::client_workstation"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux (v. 5 server)",
                "product": {
                  "name": "Red Hat Enterprise Linux (v. 5 server)",
                  "product_id": "5Server",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:enterprise_linux:5::server"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Enterprise Linux"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "dovecot-0:1.0.7-2.el5.src",
                "product": {
                  "name": "dovecot-0:1.0.7-2.el5.src",
                  "product_id": "dovecot-0:1.0.7-2.el5.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/dovecot@1.0.7-2.el5?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "dovecot-0:1.0.7-2.el5.x86_64",
                "product": {
                  "name": "dovecot-0:1.0.7-2.el5.x86_64",
                  "product_id": "dovecot-0:1.0.7-2.el5.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/dovecot@1.0.7-2.el5?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "dovecot-debuginfo-0:1.0.7-2.el5.x86_64",
                "product": {
                  "name": "dovecot-debuginfo-0:1.0.7-2.el5.x86_64",
                  "product_id": "dovecot-debuginfo-0:1.0.7-2.el5.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/dovecot-debuginfo@1.0.7-2.el5?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "dovecot-0:1.0.7-2.el5.i386",
                "product": {
                  "name": "dovecot-0:1.0.7-2.el5.i386",
                  "product_id": "dovecot-0:1.0.7-2.el5.i386",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/dovecot@1.0.7-2.el5?arch=i386"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "dovecot-debuginfo-0:1.0.7-2.el5.i386",
                "product": {
                  "name": "dovecot-debuginfo-0:1.0.7-2.el5.i386",
                  "product_id": "dovecot-debuginfo-0:1.0.7-2.el5.i386",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/dovecot-debuginfo@1.0.7-2.el5?arch=i386"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "i386"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "dovecot-0:1.0.7-2.el5.ia64",
                "product": {
                  "name": "dovecot-0:1.0.7-2.el5.ia64",
                  "product_id": "dovecot-0:1.0.7-2.el5.ia64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/dovecot@1.0.7-2.el5?arch=ia64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "dovecot-debuginfo-0:1.0.7-2.el5.ia64",
                "product": {
                  "name": "dovecot-debuginfo-0:1.0.7-2.el5.ia64",
                  "product_id": "dovecot-debuginfo-0:1.0.7-2.el5.ia64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/dovecot-debuginfo@1.0.7-2.el5?arch=ia64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ia64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "dovecot-0:1.0.7-2.el5.ppc",
                "product": {
                  "name": "dovecot-0:1.0.7-2.el5.ppc",
                  "product_id": "dovecot-0:1.0.7-2.el5.ppc",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/dovecot@1.0.7-2.el5?arch=ppc"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "dovecot-debuginfo-0:1.0.7-2.el5.ppc",
                "product": {
                  "name": "dovecot-debuginfo-0:1.0.7-2.el5.ppc",
                  "product_id": "dovecot-debuginfo-0:1.0.7-2.el5.ppc",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/dovecot-debuginfo@1.0.7-2.el5?arch=ppc"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "dovecot-0:1.0.7-2.el5.s390x",
                "product": {
                  "name": "dovecot-0:1.0.7-2.el5.s390x",
                  "product_id": "dovecot-0:1.0.7-2.el5.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/dovecot@1.0.7-2.el5?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "dovecot-debuginfo-0:1.0.7-2.el5.s390x",
                "product": {
                  "name": "dovecot-debuginfo-0:1.0.7-2.el5.s390x",
                  "product_id": "dovecot-debuginfo-0:1.0.7-2.el5.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/dovecot-debuginfo@1.0.7-2.el5?arch=s390x"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "dovecot-0:1.0.7-2.el5.i386 as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)",
          "product_id": "5Client-Workstation:dovecot-0:1.0.7-2.el5.i386"
        },
        "product_reference": "dovecot-0:1.0.7-2.el5.i386",
        "relates_to_product_reference": "5Client-Workstation"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "dovecot-0:1.0.7-2.el5.ia64 as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)",
          "product_id": "5Client-Workstation:dovecot-0:1.0.7-2.el5.ia64"
        },
        "product_reference": "dovecot-0:1.0.7-2.el5.ia64",
        "relates_to_product_reference": "5Client-Workstation"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "dovecot-0:1.0.7-2.el5.ppc as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)",
          "product_id": "5Client-Workstation:dovecot-0:1.0.7-2.el5.ppc"
        },
        "product_reference": "dovecot-0:1.0.7-2.el5.ppc",
        "relates_to_product_reference": "5Client-Workstation"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "dovecot-0:1.0.7-2.el5.s390x as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)",
          "product_id": "5Client-Workstation:dovecot-0:1.0.7-2.el5.s390x"
        },
        "product_reference": "dovecot-0:1.0.7-2.el5.s390x",
        "relates_to_product_reference": "5Client-Workstation"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "dovecot-0:1.0.7-2.el5.src as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)",
          "product_id": "5Client-Workstation:dovecot-0:1.0.7-2.el5.src"
        },
        "product_reference": "dovecot-0:1.0.7-2.el5.src",
        "relates_to_product_reference": "5Client-Workstation"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "dovecot-0:1.0.7-2.el5.x86_64 as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)",
          "product_id": "5Client-Workstation:dovecot-0:1.0.7-2.el5.x86_64"
        },
        "product_reference": "dovecot-0:1.0.7-2.el5.x86_64",
        "relates_to_product_reference": "5Client-Workstation"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "dovecot-debuginfo-0:1.0.7-2.el5.i386 as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)",
          "product_id": "5Client-Workstation:dovecot-debuginfo-0:1.0.7-2.el5.i386"
        },
        "product_reference": "dovecot-debuginfo-0:1.0.7-2.el5.i386",
        "relates_to_product_reference": "5Client-Workstation"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "dovecot-debuginfo-0:1.0.7-2.el5.ia64 as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)",
          "product_id": "5Client-Workstation:dovecot-debuginfo-0:1.0.7-2.el5.ia64"
        },
        "product_reference": "dovecot-debuginfo-0:1.0.7-2.el5.ia64",
        "relates_to_product_reference": "5Client-Workstation"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "dovecot-debuginfo-0:1.0.7-2.el5.ppc as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)",
          "product_id": "5Client-Workstation:dovecot-debuginfo-0:1.0.7-2.el5.ppc"
        },
        "product_reference": "dovecot-debuginfo-0:1.0.7-2.el5.ppc",
        "relates_to_product_reference": "5Client-Workstation"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "dovecot-debuginfo-0:1.0.7-2.el5.s390x as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)",
          "product_id": "5Client-Workstation:dovecot-debuginfo-0:1.0.7-2.el5.s390x"
        },
        "product_reference": "dovecot-debuginfo-0:1.0.7-2.el5.s390x",
        "relates_to_product_reference": "5Client-Workstation"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "dovecot-debuginfo-0:1.0.7-2.el5.x86_64 as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)",
          "product_id": "5Client-Workstation:dovecot-debuginfo-0:1.0.7-2.el5.x86_64"
        },
        "product_reference": "dovecot-debuginfo-0:1.0.7-2.el5.x86_64",
        "relates_to_product_reference": "5Client-Workstation"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "dovecot-0:1.0.7-2.el5.i386 as a component of Red Hat Enterprise Linux (v. 5 server)",
          "product_id": "5Server:dovecot-0:1.0.7-2.el5.i386"
        },
        "product_reference": "dovecot-0:1.0.7-2.el5.i386",
        "relates_to_product_reference": "5Server"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "dovecot-0:1.0.7-2.el5.ia64 as a component of Red Hat Enterprise Linux (v. 5 server)",
          "product_id": "5Server:dovecot-0:1.0.7-2.el5.ia64"
        },
        "product_reference": "dovecot-0:1.0.7-2.el5.ia64",
        "relates_to_product_reference": "5Server"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "dovecot-0:1.0.7-2.el5.ppc as a component of Red Hat Enterprise Linux (v. 5 server)",
          "product_id": "5Server:dovecot-0:1.0.7-2.el5.ppc"
        },
        "product_reference": "dovecot-0:1.0.7-2.el5.ppc",
        "relates_to_product_reference": "5Server"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "dovecot-0:1.0.7-2.el5.s390x as a component of Red Hat Enterprise Linux (v. 5 server)",
          "product_id": "5Server:dovecot-0:1.0.7-2.el5.s390x"
        },
        "product_reference": "dovecot-0:1.0.7-2.el5.s390x",
        "relates_to_product_reference": "5Server"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "dovecot-0:1.0.7-2.el5.src as a component of Red Hat Enterprise Linux (v. 5 server)",
          "product_id": "5Server:dovecot-0:1.0.7-2.el5.src"
        },
        "product_reference": "dovecot-0:1.0.7-2.el5.src",
        "relates_to_product_reference": "5Server"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "dovecot-0:1.0.7-2.el5.x86_64 as a component of Red Hat Enterprise Linux (v. 5 server)",
          "product_id": "5Server:dovecot-0:1.0.7-2.el5.x86_64"
        },
        "product_reference": "dovecot-0:1.0.7-2.el5.x86_64",
        "relates_to_product_reference": "5Server"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "dovecot-debuginfo-0:1.0.7-2.el5.i386 as a component of Red Hat Enterprise Linux (v. 5 server)",
          "product_id": "5Server:dovecot-debuginfo-0:1.0.7-2.el5.i386"
        },
        "product_reference": "dovecot-debuginfo-0:1.0.7-2.el5.i386",
        "relates_to_product_reference": "5Server"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "dovecot-debuginfo-0:1.0.7-2.el5.ia64 as a component of Red Hat Enterprise Linux (v. 5 server)",
          "product_id": "5Server:dovecot-debuginfo-0:1.0.7-2.el5.ia64"
        },
        "product_reference": "dovecot-debuginfo-0:1.0.7-2.el5.ia64",
        "relates_to_product_reference": "5Server"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "dovecot-debuginfo-0:1.0.7-2.el5.ppc as a component of Red Hat Enterprise Linux (v. 5 server)",
          "product_id": "5Server:dovecot-debuginfo-0:1.0.7-2.el5.ppc"
        },
        "product_reference": "dovecot-debuginfo-0:1.0.7-2.el5.ppc",
        "relates_to_product_reference": "5Server"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "dovecot-debuginfo-0:1.0.7-2.el5.s390x as a component of Red Hat Enterprise Linux (v. 5 server)",
          "product_id": "5Server:dovecot-debuginfo-0:1.0.7-2.el5.s390x"
        },
        "product_reference": "dovecot-debuginfo-0:1.0.7-2.el5.s390x",
        "relates_to_product_reference": "5Server"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "dovecot-debuginfo-0:1.0.7-2.el5.x86_64 as a component of Red Hat Enterprise Linux (v. 5 server)",
          "product_id": "5Server:dovecot-debuginfo-0:1.0.7-2.el5.x86_64"
        },
        "product_reference": "dovecot-debuginfo-0:1.0.7-2.el5.x86_64",
        "relates_to_product_reference": "5Server"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2007-2231",
      "discovery_date": "2007-04-25T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "238439"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Directory traversal vulnerability in index/mbox/mbox-storage.c in Dovecot before 1.0.rc29, when using the zlib plugin, allows remote attackers to read arbitrary gzipped (.gz) mailboxes (mbox files) via a .. (dot dot) sequence in the mailbox name.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "Directory traversal in dovecot with zlib plugin",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This issue did not affect Red Hat Enterprise Linux prior to version 5.",
          "title": "Statement"
        }
      ],
      "product_status": {
        "fixed": [
          "5Client-Workstation:dovecot-0:1.0.7-2.el5.i386",
          "5Client-Workstation:dovecot-0:1.0.7-2.el5.ia64",
          "5Client-Workstation:dovecot-0:1.0.7-2.el5.ppc",
          "5Client-Workstation:dovecot-0:1.0.7-2.el5.s390x",
          "5Client-Workstation:dovecot-0:1.0.7-2.el5.src",
          "5Client-Workstation:dovecot-0:1.0.7-2.el5.x86_64",
          "5Client-Workstation:dovecot-debuginfo-0:1.0.7-2.el5.i386",
          "5Client-Workstation:dovecot-debuginfo-0:1.0.7-2.el5.ia64",
          "5Client-Workstation:dovecot-debuginfo-0:1.0.7-2.el5.ppc",
          "5Client-Workstation:dovecot-debuginfo-0:1.0.7-2.el5.s390x",
          "5Client-Workstation:dovecot-debuginfo-0:1.0.7-2.el5.x86_64",
          "5Server:dovecot-0:1.0.7-2.el5.i386",
          "5Server:dovecot-0:1.0.7-2.el5.ia64",
          "5Server:dovecot-0:1.0.7-2.el5.ppc",
          "5Server:dovecot-0:1.0.7-2.el5.s390x",
          "5Server:dovecot-0:1.0.7-2.el5.src",
          "5Server:dovecot-0:1.0.7-2.el5.x86_64",
          "5Server:dovecot-debuginfo-0:1.0.7-2.el5.i386",
          "5Server:dovecot-debuginfo-0:1.0.7-2.el5.ia64",
          "5Server:dovecot-debuginfo-0:1.0.7-2.el5.ppc",
          "5Server:dovecot-debuginfo-0:1.0.7-2.el5.s390x",
          "5Server:dovecot-debuginfo-0:1.0.7-2.el5.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2007-2231"
        },
        {
          "category": "external",
          "summary": "RHBZ#238439",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=238439"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2007-2231",
          "url": "https://www.cve.org/CVERecord?id=CVE-2007-2231"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2007-2231",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2007-2231"
        }
      ],
      "release_date": "2007-03-28T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2008-05-20T14:28:00+00:00",
          "details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.  \n\nThis update is available via Red Hat Network.  Details on how to use \nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/FAQ_58_10188",
          "product_ids": [
            "5Client-Workstation:dovecot-0:1.0.7-2.el5.i386",
            "5Client-Workstation:dovecot-0:1.0.7-2.el5.ia64",
            "5Client-Workstation:dovecot-0:1.0.7-2.el5.ppc",
            "5Client-Workstation:dovecot-0:1.0.7-2.el5.s390x",
            "5Client-Workstation:dovecot-0:1.0.7-2.el5.src",
            "5Client-Workstation:dovecot-0:1.0.7-2.el5.x86_64",
            "5Client-Workstation:dovecot-debuginfo-0:1.0.7-2.el5.i386",
            "5Client-Workstation:dovecot-debuginfo-0:1.0.7-2.el5.ia64",
            "5Client-Workstation:dovecot-debuginfo-0:1.0.7-2.el5.ppc",
            "5Client-Workstation:dovecot-debuginfo-0:1.0.7-2.el5.s390x",
            "5Client-Workstation:dovecot-debuginfo-0:1.0.7-2.el5.x86_64",
            "5Server:dovecot-0:1.0.7-2.el5.i386",
            "5Server:dovecot-0:1.0.7-2.el5.ia64",
            "5Server:dovecot-0:1.0.7-2.el5.ppc",
            "5Server:dovecot-0:1.0.7-2.el5.s390x",
            "5Server:dovecot-0:1.0.7-2.el5.src",
            "5Server:dovecot-0:1.0.7-2.el5.x86_64",
            "5Server:dovecot-debuginfo-0:1.0.7-2.el5.i386",
            "5Server:dovecot-debuginfo-0:1.0.7-2.el5.ia64",
            "5Server:dovecot-debuginfo-0:1.0.7-2.el5.ppc",
            "5Server:dovecot-debuginfo-0:1.0.7-2.el5.s390x",
            "5Server:dovecot-debuginfo-0:1.0.7-2.el5.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2008:0297"
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "Directory traversal in dovecot with zlib plugin"
    },
    {
      "cve": "CVE-2007-4211",
      "discovery_date": "2007-08-03T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "251007"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "The ACL plugin in Dovecot before 1.0.3 allows remote authenticated users with the insert right to save certain flags via a (1) COPY or (2) APPEND command.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "Dovecot possible privilege ascalation in ACL plugin",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "These issues did not affect the dovecot versions as shipped with Red Hat Enterprise Linux 2.1, 3, or 4.",
          "title": "Statement"
        }
      ],
      "product_status": {
        "fixed": [
          "5Client-Workstation:dovecot-0:1.0.7-2.el5.i386",
          "5Client-Workstation:dovecot-0:1.0.7-2.el5.ia64",
          "5Client-Workstation:dovecot-0:1.0.7-2.el5.ppc",
          "5Client-Workstation:dovecot-0:1.0.7-2.el5.s390x",
          "5Client-Workstation:dovecot-0:1.0.7-2.el5.src",
          "5Client-Workstation:dovecot-0:1.0.7-2.el5.x86_64",
          "5Client-Workstation:dovecot-debuginfo-0:1.0.7-2.el5.i386",
          "5Client-Workstation:dovecot-debuginfo-0:1.0.7-2.el5.ia64",
          "5Client-Workstation:dovecot-debuginfo-0:1.0.7-2.el5.ppc",
          "5Client-Workstation:dovecot-debuginfo-0:1.0.7-2.el5.s390x",
          "5Client-Workstation:dovecot-debuginfo-0:1.0.7-2.el5.x86_64",
          "5Server:dovecot-0:1.0.7-2.el5.i386",
          "5Server:dovecot-0:1.0.7-2.el5.ia64",
          "5Server:dovecot-0:1.0.7-2.el5.ppc",
          "5Server:dovecot-0:1.0.7-2.el5.s390x",
          "5Server:dovecot-0:1.0.7-2.el5.src",
          "5Server:dovecot-0:1.0.7-2.el5.x86_64",
          "5Server:dovecot-debuginfo-0:1.0.7-2.el5.i386",
          "5Server:dovecot-debuginfo-0:1.0.7-2.el5.ia64",
          "5Server:dovecot-debuginfo-0:1.0.7-2.el5.ppc",
          "5Server:dovecot-debuginfo-0:1.0.7-2.el5.s390x",
          "5Server:dovecot-debuginfo-0:1.0.7-2.el5.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2007-4211"
        },
        {
          "category": "external",
          "summary": "RHBZ#251007",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=251007"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2007-4211",
          "url": "https://www.cve.org/CVERecord?id=CVE-2007-4211"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2007-4211",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2007-4211"
        }
      ],
      "release_date": "2007-08-01T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2008-05-20T14:28:00+00:00",
          "details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.  \n\nThis update is available via Red Hat Network.  Details on how to use \nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/FAQ_58_10188",
          "product_ids": [
            "5Client-Workstation:dovecot-0:1.0.7-2.el5.i386",
            "5Client-Workstation:dovecot-0:1.0.7-2.el5.ia64",
            "5Client-Workstation:dovecot-0:1.0.7-2.el5.ppc",
            "5Client-Workstation:dovecot-0:1.0.7-2.el5.s390x",
            "5Client-Workstation:dovecot-0:1.0.7-2.el5.src",
            "5Client-Workstation:dovecot-0:1.0.7-2.el5.x86_64",
            "5Client-Workstation:dovecot-debuginfo-0:1.0.7-2.el5.i386",
            "5Client-Workstation:dovecot-debuginfo-0:1.0.7-2.el5.ia64",
            "5Client-Workstation:dovecot-debuginfo-0:1.0.7-2.el5.ppc",
            "5Client-Workstation:dovecot-debuginfo-0:1.0.7-2.el5.s390x",
            "5Client-Workstation:dovecot-debuginfo-0:1.0.7-2.el5.x86_64",
            "5Server:dovecot-0:1.0.7-2.el5.i386",
            "5Server:dovecot-0:1.0.7-2.el5.ia64",
            "5Server:dovecot-0:1.0.7-2.el5.ppc",
            "5Server:dovecot-0:1.0.7-2.el5.s390x",
            "5Server:dovecot-0:1.0.7-2.el5.src",
            "5Server:dovecot-0:1.0.7-2.el5.x86_64",
            "5Server:dovecot-debuginfo-0:1.0.7-2.el5.i386",
            "5Server:dovecot-debuginfo-0:1.0.7-2.el5.ia64",
            "5Server:dovecot-debuginfo-0:1.0.7-2.el5.ppc",
            "5Server:dovecot-debuginfo-0:1.0.7-2.el5.s390x",
            "5Server:dovecot-debuginfo-0:1.0.7-2.el5.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2008:0297"
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "Dovecot possible privilege ascalation in ACL plugin"
    },
    {
      "cve": "CVE-2007-6598",
      "discovery_date": "2007-12-29T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "427575"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Dovecot before 1.0.10, with certain configuration options including use of %variables, does not properly maintain the LDAP+auth cache, which might allow remote authenticated users to login as a different user who has the same password.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "dovecot LDAP+auth cache user login mixup",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This issue did not affect versions of Dovecot as shipped with Red Hat Enterprise Linux before version 5.",
          "title": "Statement"
        }
      ],
      "product_status": {
        "fixed": [
          "5Client-Workstation:dovecot-0:1.0.7-2.el5.i386",
          "5Client-Workstation:dovecot-0:1.0.7-2.el5.ia64",
          "5Client-Workstation:dovecot-0:1.0.7-2.el5.ppc",
          "5Client-Workstation:dovecot-0:1.0.7-2.el5.s390x",
          "5Client-Workstation:dovecot-0:1.0.7-2.el5.src",
          "5Client-Workstation:dovecot-0:1.0.7-2.el5.x86_64",
          "5Client-Workstation:dovecot-debuginfo-0:1.0.7-2.el5.i386",
          "5Client-Workstation:dovecot-debuginfo-0:1.0.7-2.el5.ia64",
          "5Client-Workstation:dovecot-debuginfo-0:1.0.7-2.el5.ppc",
          "5Client-Workstation:dovecot-debuginfo-0:1.0.7-2.el5.s390x",
          "5Client-Workstation:dovecot-debuginfo-0:1.0.7-2.el5.x86_64",
          "5Server:dovecot-0:1.0.7-2.el5.i386",
          "5Server:dovecot-0:1.0.7-2.el5.ia64",
          "5Server:dovecot-0:1.0.7-2.el5.ppc",
          "5Server:dovecot-0:1.0.7-2.el5.s390x",
          "5Server:dovecot-0:1.0.7-2.el5.src",
          "5Server:dovecot-0:1.0.7-2.el5.x86_64",
          "5Server:dovecot-debuginfo-0:1.0.7-2.el5.i386",
          "5Server:dovecot-debuginfo-0:1.0.7-2.el5.ia64",
          "5Server:dovecot-debuginfo-0:1.0.7-2.el5.ppc",
          "5Server:dovecot-debuginfo-0:1.0.7-2.el5.s390x",
          "5Server:dovecot-debuginfo-0:1.0.7-2.el5.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2007-6598"
        },
        {
          "category": "external",
          "summary": "RHBZ#427575",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=427575"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2007-6598",
          "url": "https://www.cve.org/CVERecord?id=CVE-2007-6598"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2007-6598",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2007-6598"
        }
      ],
      "release_date": "2007-12-29T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2008-05-20T14:28:00+00:00",
          "details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.  \n\nThis update is available via Red Hat Network.  Details on how to use \nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/FAQ_58_10188",
          "product_ids": [
            "5Client-Workstation:dovecot-0:1.0.7-2.el5.i386",
            "5Client-Workstation:dovecot-0:1.0.7-2.el5.ia64",
            "5Client-Workstation:dovecot-0:1.0.7-2.el5.ppc",
            "5Client-Workstation:dovecot-0:1.0.7-2.el5.s390x",
            "5Client-Workstation:dovecot-0:1.0.7-2.el5.src",
            "5Client-Workstation:dovecot-0:1.0.7-2.el5.x86_64",
            "5Client-Workstation:dovecot-debuginfo-0:1.0.7-2.el5.i386",
            "5Client-Workstation:dovecot-debuginfo-0:1.0.7-2.el5.ia64",
            "5Client-Workstation:dovecot-debuginfo-0:1.0.7-2.el5.ppc",
            "5Client-Workstation:dovecot-debuginfo-0:1.0.7-2.el5.s390x",
            "5Client-Workstation:dovecot-debuginfo-0:1.0.7-2.el5.x86_64",
            "5Server:dovecot-0:1.0.7-2.el5.i386",
            "5Server:dovecot-0:1.0.7-2.el5.ia64",
            "5Server:dovecot-0:1.0.7-2.el5.ppc",
            "5Server:dovecot-0:1.0.7-2.el5.s390x",
            "5Server:dovecot-0:1.0.7-2.el5.src",
            "5Server:dovecot-0:1.0.7-2.el5.x86_64",
            "5Server:dovecot-debuginfo-0:1.0.7-2.el5.i386",
            "5Server:dovecot-debuginfo-0:1.0.7-2.el5.ia64",
            "5Server:dovecot-debuginfo-0:1.0.7-2.el5.ppc",
            "5Server:dovecot-debuginfo-0:1.0.7-2.el5.s390x",
            "5Server:dovecot-debuginfo-0:1.0.7-2.el5.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2008:0297"
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "dovecot LDAP+auth cache user login mixup"
    },
    {
      "cve": "CVE-2008-1199",
      "discovery_date": "2008-03-01T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "436927"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Dovecot before 1.0.11, when configured to use mail_extra_groups to allow Dovecot to create dotlocks in /var/mail, might allow local users to read sensitive mail files for other users, or modify files or directories that are writable by group, via a symlink attack.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "dovecot: insecure mail_extra_groups option",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This issue does not affect the default configuration of Dovecot as shipped in Red Hat Enterprise Linux.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "5Client-Workstation:dovecot-0:1.0.7-2.el5.i386",
          "5Client-Workstation:dovecot-0:1.0.7-2.el5.ia64",
          "5Client-Workstation:dovecot-0:1.0.7-2.el5.ppc",
          "5Client-Workstation:dovecot-0:1.0.7-2.el5.s390x",
          "5Client-Workstation:dovecot-0:1.0.7-2.el5.src",
          "5Client-Workstation:dovecot-0:1.0.7-2.el5.x86_64",
          "5Client-Workstation:dovecot-debuginfo-0:1.0.7-2.el5.i386",
          "5Client-Workstation:dovecot-debuginfo-0:1.0.7-2.el5.ia64",
          "5Client-Workstation:dovecot-debuginfo-0:1.0.7-2.el5.ppc",
          "5Client-Workstation:dovecot-debuginfo-0:1.0.7-2.el5.s390x",
          "5Client-Workstation:dovecot-debuginfo-0:1.0.7-2.el5.x86_64",
          "5Server:dovecot-0:1.0.7-2.el5.i386",
          "5Server:dovecot-0:1.0.7-2.el5.ia64",
          "5Server:dovecot-0:1.0.7-2.el5.ppc",
          "5Server:dovecot-0:1.0.7-2.el5.s390x",
          "5Server:dovecot-0:1.0.7-2.el5.src",
          "5Server:dovecot-0:1.0.7-2.el5.x86_64",
          "5Server:dovecot-debuginfo-0:1.0.7-2.el5.i386",
          "5Server:dovecot-debuginfo-0:1.0.7-2.el5.ia64",
          "5Server:dovecot-debuginfo-0:1.0.7-2.el5.ppc",
          "5Server:dovecot-debuginfo-0:1.0.7-2.el5.s390x",
          "5Server:dovecot-debuginfo-0:1.0.7-2.el5.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2008-1199"
        },
        {
          "category": "external",
          "summary": "RHBZ#436927",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=436927"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2008-1199",
          "url": "https://www.cve.org/CVERecord?id=CVE-2008-1199"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2008-1199",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2008-1199"
        }
      ],
      "release_date": "2008-03-04T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2008-05-20T14:28:00+00:00",
          "details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.  \n\nThis update is available via Red Hat Network.  Details on how to use \nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/FAQ_58_10188",
          "product_ids": [
            "5Client-Workstation:dovecot-0:1.0.7-2.el5.i386",
            "5Client-Workstation:dovecot-0:1.0.7-2.el5.ia64",
            "5Client-Workstation:dovecot-0:1.0.7-2.el5.ppc",
            "5Client-Workstation:dovecot-0:1.0.7-2.el5.s390x",
            "5Client-Workstation:dovecot-0:1.0.7-2.el5.src",
            "5Client-Workstation:dovecot-0:1.0.7-2.el5.x86_64",
            "5Client-Workstation:dovecot-debuginfo-0:1.0.7-2.el5.i386",
            "5Client-Workstation:dovecot-debuginfo-0:1.0.7-2.el5.ia64",
            "5Client-Workstation:dovecot-debuginfo-0:1.0.7-2.el5.ppc",
            "5Client-Workstation:dovecot-debuginfo-0:1.0.7-2.el5.s390x",
            "5Client-Workstation:dovecot-debuginfo-0:1.0.7-2.el5.x86_64",
            "5Server:dovecot-0:1.0.7-2.el5.i386",
            "5Server:dovecot-0:1.0.7-2.el5.ia64",
            "5Server:dovecot-0:1.0.7-2.el5.ppc",
            "5Server:dovecot-0:1.0.7-2.el5.s390x",
            "5Server:dovecot-0:1.0.7-2.el5.src",
            "5Server:dovecot-0:1.0.7-2.el5.x86_64",
            "5Server:dovecot-debuginfo-0:1.0.7-2.el5.i386",
            "5Server:dovecot-debuginfo-0:1.0.7-2.el5.ia64",
            "5Server:dovecot-debuginfo-0:1.0.7-2.el5.ppc",
            "5Server:dovecot-debuginfo-0:1.0.7-2.el5.s390x",
            "5Server:dovecot-debuginfo-0:1.0.7-2.el5.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2008:0297"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "HIGH",
            "accessVector": "LOCAL",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 3.7,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:L/AC:H/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          "products": [
            "5Client-Workstation:dovecot-0:1.0.7-2.el5.i386",
            "5Client-Workstation:dovecot-0:1.0.7-2.el5.ia64",
            "5Client-Workstation:dovecot-0:1.0.7-2.el5.ppc",
            "5Client-Workstation:dovecot-0:1.0.7-2.el5.s390x",
            "5Client-Workstation:dovecot-0:1.0.7-2.el5.src",
            "5Client-Workstation:dovecot-0:1.0.7-2.el5.x86_64",
            "5Client-Workstation:dovecot-debuginfo-0:1.0.7-2.el5.i386",
            "5Client-Workstation:dovecot-debuginfo-0:1.0.7-2.el5.ia64",
            "5Client-Workstation:dovecot-debuginfo-0:1.0.7-2.el5.ppc",
            "5Client-Workstation:dovecot-debuginfo-0:1.0.7-2.el5.s390x",
            "5Client-Workstation:dovecot-debuginfo-0:1.0.7-2.el5.x86_64",
            "5Server:dovecot-0:1.0.7-2.el5.i386",
            "5Server:dovecot-0:1.0.7-2.el5.ia64",
            "5Server:dovecot-0:1.0.7-2.el5.ppc",
            "5Server:dovecot-0:1.0.7-2.el5.s390x",
            "5Server:dovecot-0:1.0.7-2.el5.src",
            "5Server:dovecot-0:1.0.7-2.el5.x86_64",
            "5Server:dovecot-debuginfo-0:1.0.7-2.el5.i386",
            "5Server:dovecot-debuginfo-0:1.0.7-2.el5.ia64",
            "5Server:dovecot-debuginfo-0:1.0.7-2.el5.ppc",
            "5Server:dovecot-debuginfo-0:1.0.7-2.el5.s390x",
            "5Server:dovecot-debuginfo-0:1.0.7-2.el5.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "dovecot: insecure mail_extra_groups option"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.