RHSA-2008_0297
Vulnerability from csaf_redhat - Published: 2008-05-20 14:28 - Updated: 2024-11-22 01:40Summary
Red Hat Security Advisory: dovecot security and bug fix update
Severity
Low
Notes
Topic: An updated dovecot package that fixes several security issues and various
bugs is now available for Red Hat Enterprise Linux 5.
This update has been rated as having low security impact by the Red Hat
Security Response Team.
Details: Dovecot is an IMAP server for Linux and UNIX-like systems, primarily
written with security in mind.
A flaw was discovered in the way Dovecot handled the "mail_extra_groups"
option. An authenticated attacker with local shell access could leverage
this flaw to read, modify, or delete other users mail that is stored on
the mail server. (CVE-2008-1199)
This issue did not affect the default Red Hat Enterprise Linux 5 Dovecot
configuration. This update adds two new configuration options --
"mail_privileged_group" and "mail_access_groups" -- to minimize the usage
of additional privileges.
A directory traversal flaw was discovered in Dovecot's zlib plug-in. An
authenticated user could use this flaw to view other compressed mailboxes
with the permissions of the Dovecot process. (CVE-2007-2231)
A flaw was found in the Dovecot ACL plug-in. User with only insert
permissions for a mailbox could use the "COPY" and "APPEND" commands to set
additional message flags. (CVE-2007-4211)
A flaw was found in a way Dovecot cached LDAP query results in certain
configurations. This could possibly allow authenticated users to log in as
a different user who has the same password. (CVE-2007-6598)
As well, this updated package fixes the following bugs:
* configuring "userdb" and "passdb" to use LDAP caused Dovecot to hang. A
segmentation fault may have occurred. In this updated package, using an
LDAP backend for "userdb" and "passdb" no longer causes Dovecot to hang.
* the Dovecot "login_process_size" limit was configured for 32-bit systems.
On 64-bit systems, when Dovecot was configured to use either IMAP or POP3,
the log in processes crashed with out-of-memory errors. Errors such as the
following were logged:
pop3-login: pop3-login: error while loading shared libraries:
libsepol.so.1: failed to map segment from shared object: Cannot allocate
memory
In this updated package, the "login_process_size" limit is correctly
configured on 64-bit systems, which resolves this issue.
Note: this updated package upgrades dovecot to version 1.0.7. For
further details, refer to the Dovecot changelog:
http://koji.fedoraproject.org/koji/buildinfo?buildID=23397
Users of dovecot are advised to upgrade to this updated package, which
resolves these issues.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
Directory traversal vulnerability in index/mbox/mbox-storage.c in Dovecot before 1.0.rc29, when using the zlib plugin, allows remote attackers to read arbitrary gzipped (.gz) mailboxes (mbox files) via a .. (dot dot) sequence in the mailbox name.
Vendor Fix
Before applying this update, make sure that all previously-released
errata relevant to your system have been applied.
This update is available via Red Hat Network. Details on how to use
the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/FAQ_58_10188
https://access.redhat.com/errata/RHSA-2008:0297
The ACL plugin in Dovecot before 1.0.3 allows remote authenticated users with the insert right to save certain flags via a (1) COPY or (2) APPEND command.
Vendor Fix
Before applying this update, make sure that all previously-released
errata relevant to your system have been applied.
This update is available via Red Hat Network. Details on how to use
the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/FAQ_58_10188
https://access.redhat.com/errata/RHSA-2008:0297
Dovecot before 1.0.10, with certain configuration options including use of %variables, does not properly maintain the LDAP+auth cache, which might allow remote authenticated users to login as a different user who has the same password.
Vendor Fix
Before applying this update, make sure that all previously-released
errata relevant to your system have been applied.
This update is available via Red Hat Network. Details on how to use
the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/FAQ_58_10188
https://access.redhat.com/errata/RHSA-2008:0297
Dovecot before 1.0.11, when configured to use mail_extra_groups to allow Dovecot to create dotlocks in /var/mail, might allow local users to read sensitive mail files for other users, or modify files or directories that are writable by group, via a symlink attack.
3.7 ()
Vendor Fix
Before applying this update, make sure that all previously-released
errata relevant to your system have been applied.
This update is available via Red Hat Network. Details on how to use
the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/FAQ_58_10188
https://access.redhat.com/errata/RHSA-2008:0297
References
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Low"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An updated dovecot package that fixes several security issues and various\nbugs is now available for Red Hat Enterprise Linux 5.\n\nThis update has been rated as having low security impact by the Red Hat\nSecurity Response Team.",
"title": "Topic"
},
{
"category": "general",
"text": "Dovecot is an IMAP server for Linux and UNIX-like systems, primarily\nwritten with security in mind.\n\nA flaw was discovered in the way Dovecot handled the \"mail_extra_groups\"\noption. An authenticated attacker with local shell access could leverage\nthis flaw to read, modify, or delete other users mail that is stored on\nthe mail server. (CVE-2008-1199)\n\nThis issue did not affect the default Red Hat Enterprise Linux 5 Dovecot\nconfiguration. This update adds two new configuration options --\n\"mail_privileged_group\" and \"mail_access_groups\" -- to minimize the usage\nof additional privileges.\n\nA directory traversal flaw was discovered in Dovecot\u0027s zlib plug-in. An\nauthenticated user could use this flaw to view other compressed mailboxes\nwith the permissions of the Dovecot process. (CVE-2007-2231)\n\nA flaw was found in the Dovecot ACL plug-in. User with only insert\npermissions for a mailbox could use the \"COPY\" and \"APPEND\" commands to set\nadditional message flags. (CVE-2007-4211)\n\nA flaw was found in a way Dovecot cached LDAP query results in certain\nconfigurations. This could possibly allow authenticated users to log in as\na different user who has the same password. (CVE-2007-6598)\n\nAs well, this updated package fixes the following bugs:\n\n* configuring \"userdb\" and \"passdb\" to use LDAP caused Dovecot to hang. A\nsegmentation fault may have occurred. In this updated package, using an\nLDAP backend for \"userdb\" and \"passdb\" no longer causes Dovecot to hang.\n\n* the Dovecot \"login_process_size\" limit was configured for 32-bit systems.\nOn 64-bit systems, when Dovecot was configured to use either IMAP or POP3,\nthe log in processes crashed with out-of-memory errors. Errors such as the\nfollowing were logged:\n\npop3-login: pop3-login: error while loading shared libraries:\nlibsepol.so.1: failed to map segment from shared object: Cannot allocate\nmemory\n\nIn this updated package, the \"login_process_size\" limit is correctly\nconfigured on 64-bit systems, which resolves this issue.\n\nNote: this updated package upgrades dovecot to version 1.0.7. For\nfurther details, refer to the Dovecot changelog:\nhttp://koji.fedoraproject.org/koji/buildinfo?buildID=23397\n\nUsers of dovecot are advised to upgrade to this updated package, which\nresolves these issues.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2008:0297",
"url": "https://access.redhat.com/errata/RHSA-2008:0297"
},
{
"category": "external",
"summary": "http://www.redhat.com/security/updates/classification/#low",
"url": "http://www.redhat.com/security/updates/classification/#low"
},
{
"category": "external",
"summary": "238439",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=238439"
},
{
"category": "external",
"summary": "245249",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=245249"
},
{
"category": "external",
"summary": "251007",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=251007"
},
{
"category": "external",
"summary": "253363",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=253363"
},
{
"category": "external",
"summary": "331441",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=331441"
},
{
"category": "external",
"summary": "380401",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=380401"
},
{
"category": "external",
"summary": "427575",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=427575"
},
{
"category": "external",
"summary": "436927",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=436927"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2008/rhsa-2008_0297.json"
}
],
"title": "Red Hat Security Advisory: dovecot security and bug fix update",
"tracking": {
"current_release_date": "2024-11-22T01:40:32+00:00",
"generator": {
"date": "2024-11-22T01:40:32+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.2.1"
}
},
"id": "RHSA-2008:0297",
"initial_release_date": "2008-05-20T14:28:00+00:00",
"revision_history": [
{
"date": "2008-05-20T14:28:00+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2008-05-21T10:20:08+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-11-22T01:40:32+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux Desktop Workstation (v. 5 client)",
"product": {
"name": "Red Hat Enterprise Linux Desktop Workstation (v. 5 client)",
"product_id": "5Client-Workstation",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:5::client_workstation"
}
}
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux (v. 5 server)",
"product": {
"name": "Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:5::server"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux"
},
{
"branches": [
{
"category": "product_version",
"name": "dovecot-0:1.0.7-2.el5.src",
"product": {
"name": "dovecot-0:1.0.7-2.el5.src",
"product_id": "dovecot-0:1.0.7-2.el5.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/dovecot@1.0.7-2.el5?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "dovecot-0:1.0.7-2.el5.x86_64",
"product": {
"name": "dovecot-0:1.0.7-2.el5.x86_64",
"product_id": "dovecot-0:1.0.7-2.el5.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/dovecot@1.0.7-2.el5?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "dovecot-debuginfo-0:1.0.7-2.el5.x86_64",
"product": {
"name": "dovecot-debuginfo-0:1.0.7-2.el5.x86_64",
"product_id": "dovecot-debuginfo-0:1.0.7-2.el5.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/dovecot-debuginfo@1.0.7-2.el5?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "dovecot-0:1.0.7-2.el5.i386",
"product": {
"name": "dovecot-0:1.0.7-2.el5.i386",
"product_id": "dovecot-0:1.0.7-2.el5.i386",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/dovecot@1.0.7-2.el5?arch=i386"
}
}
},
{
"category": "product_version",
"name": "dovecot-debuginfo-0:1.0.7-2.el5.i386",
"product": {
"name": "dovecot-debuginfo-0:1.0.7-2.el5.i386",
"product_id": "dovecot-debuginfo-0:1.0.7-2.el5.i386",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/dovecot-debuginfo@1.0.7-2.el5?arch=i386"
}
}
}
],
"category": "architecture",
"name": "i386"
},
{
"branches": [
{
"category": "product_version",
"name": "dovecot-0:1.0.7-2.el5.ia64",
"product": {
"name": "dovecot-0:1.0.7-2.el5.ia64",
"product_id": "dovecot-0:1.0.7-2.el5.ia64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/dovecot@1.0.7-2.el5?arch=ia64"
}
}
},
{
"category": "product_version",
"name": "dovecot-debuginfo-0:1.0.7-2.el5.ia64",
"product": {
"name": "dovecot-debuginfo-0:1.0.7-2.el5.ia64",
"product_id": "dovecot-debuginfo-0:1.0.7-2.el5.ia64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/dovecot-debuginfo@1.0.7-2.el5?arch=ia64"
}
}
}
],
"category": "architecture",
"name": "ia64"
},
{
"branches": [
{
"category": "product_version",
"name": "dovecot-0:1.0.7-2.el5.ppc",
"product": {
"name": "dovecot-0:1.0.7-2.el5.ppc",
"product_id": "dovecot-0:1.0.7-2.el5.ppc",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/dovecot@1.0.7-2.el5?arch=ppc"
}
}
},
{
"category": "product_version",
"name": "dovecot-debuginfo-0:1.0.7-2.el5.ppc",
"product": {
"name": "dovecot-debuginfo-0:1.0.7-2.el5.ppc",
"product_id": "dovecot-debuginfo-0:1.0.7-2.el5.ppc",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/dovecot-debuginfo@1.0.7-2.el5?arch=ppc"
}
}
}
],
"category": "architecture",
"name": "ppc"
},
{
"branches": [
{
"category": "product_version",
"name": "dovecot-0:1.0.7-2.el5.s390x",
"product": {
"name": "dovecot-0:1.0.7-2.el5.s390x",
"product_id": "dovecot-0:1.0.7-2.el5.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/dovecot@1.0.7-2.el5?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "dovecot-debuginfo-0:1.0.7-2.el5.s390x",
"product": {
"name": "dovecot-debuginfo-0:1.0.7-2.el5.s390x",
"product_id": "dovecot-debuginfo-0:1.0.7-2.el5.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/dovecot-debuginfo@1.0.7-2.el5?arch=s390x"
}
}
}
],
"category": "architecture",
"name": "s390x"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "dovecot-0:1.0.7-2.el5.i386 as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)",
"product_id": "5Client-Workstation:dovecot-0:1.0.7-2.el5.i386"
},
"product_reference": "dovecot-0:1.0.7-2.el5.i386",
"relates_to_product_reference": "5Client-Workstation"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "dovecot-0:1.0.7-2.el5.ia64 as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)",
"product_id": "5Client-Workstation:dovecot-0:1.0.7-2.el5.ia64"
},
"product_reference": "dovecot-0:1.0.7-2.el5.ia64",
"relates_to_product_reference": "5Client-Workstation"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "dovecot-0:1.0.7-2.el5.ppc as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)",
"product_id": "5Client-Workstation:dovecot-0:1.0.7-2.el5.ppc"
},
"product_reference": "dovecot-0:1.0.7-2.el5.ppc",
"relates_to_product_reference": "5Client-Workstation"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "dovecot-0:1.0.7-2.el5.s390x as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)",
"product_id": "5Client-Workstation:dovecot-0:1.0.7-2.el5.s390x"
},
"product_reference": "dovecot-0:1.0.7-2.el5.s390x",
"relates_to_product_reference": "5Client-Workstation"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "dovecot-0:1.0.7-2.el5.src as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)",
"product_id": "5Client-Workstation:dovecot-0:1.0.7-2.el5.src"
},
"product_reference": "dovecot-0:1.0.7-2.el5.src",
"relates_to_product_reference": "5Client-Workstation"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "dovecot-0:1.0.7-2.el5.x86_64 as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)",
"product_id": "5Client-Workstation:dovecot-0:1.0.7-2.el5.x86_64"
},
"product_reference": "dovecot-0:1.0.7-2.el5.x86_64",
"relates_to_product_reference": "5Client-Workstation"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "dovecot-debuginfo-0:1.0.7-2.el5.i386 as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)",
"product_id": "5Client-Workstation:dovecot-debuginfo-0:1.0.7-2.el5.i386"
},
"product_reference": "dovecot-debuginfo-0:1.0.7-2.el5.i386",
"relates_to_product_reference": "5Client-Workstation"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "dovecot-debuginfo-0:1.0.7-2.el5.ia64 as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)",
"product_id": "5Client-Workstation:dovecot-debuginfo-0:1.0.7-2.el5.ia64"
},
"product_reference": "dovecot-debuginfo-0:1.0.7-2.el5.ia64",
"relates_to_product_reference": "5Client-Workstation"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "dovecot-debuginfo-0:1.0.7-2.el5.ppc as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)",
"product_id": "5Client-Workstation:dovecot-debuginfo-0:1.0.7-2.el5.ppc"
},
"product_reference": "dovecot-debuginfo-0:1.0.7-2.el5.ppc",
"relates_to_product_reference": "5Client-Workstation"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "dovecot-debuginfo-0:1.0.7-2.el5.s390x as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)",
"product_id": "5Client-Workstation:dovecot-debuginfo-0:1.0.7-2.el5.s390x"
},
"product_reference": "dovecot-debuginfo-0:1.0.7-2.el5.s390x",
"relates_to_product_reference": "5Client-Workstation"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "dovecot-debuginfo-0:1.0.7-2.el5.x86_64 as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)",
"product_id": "5Client-Workstation:dovecot-debuginfo-0:1.0.7-2.el5.x86_64"
},
"product_reference": "dovecot-debuginfo-0:1.0.7-2.el5.x86_64",
"relates_to_product_reference": "5Client-Workstation"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "dovecot-0:1.0.7-2.el5.i386 as a component of Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server:dovecot-0:1.0.7-2.el5.i386"
},
"product_reference": "dovecot-0:1.0.7-2.el5.i386",
"relates_to_product_reference": "5Server"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "dovecot-0:1.0.7-2.el5.ia64 as a component of Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server:dovecot-0:1.0.7-2.el5.ia64"
},
"product_reference": "dovecot-0:1.0.7-2.el5.ia64",
"relates_to_product_reference": "5Server"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "dovecot-0:1.0.7-2.el5.ppc as a component of Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server:dovecot-0:1.0.7-2.el5.ppc"
},
"product_reference": "dovecot-0:1.0.7-2.el5.ppc",
"relates_to_product_reference": "5Server"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "dovecot-0:1.0.7-2.el5.s390x as a component of Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server:dovecot-0:1.0.7-2.el5.s390x"
},
"product_reference": "dovecot-0:1.0.7-2.el5.s390x",
"relates_to_product_reference": "5Server"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "dovecot-0:1.0.7-2.el5.src as a component of Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server:dovecot-0:1.0.7-2.el5.src"
},
"product_reference": "dovecot-0:1.0.7-2.el5.src",
"relates_to_product_reference": "5Server"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "dovecot-0:1.0.7-2.el5.x86_64 as a component of Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server:dovecot-0:1.0.7-2.el5.x86_64"
},
"product_reference": "dovecot-0:1.0.7-2.el5.x86_64",
"relates_to_product_reference": "5Server"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "dovecot-debuginfo-0:1.0.7-2.el5.i386 as a component of Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server:dovecot-debuginfo-0:1.0.7-2.el5.i386"
},
"product_reference": "dovecot-debuginfo-0:1.0.7-2.el5.i386",
"relates_to_product_reference": "5Server"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "dovecot-debuginfo-0:1.0.7-2.el5.ia64 as a component of Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server:dovecot-debuginfo-0:1.0.7-2.el5.ia64"
},
"product_reference": "dovecot-debuginfo-0:1.0.7-2.el5.ia64",
"relates_to_product_reference": "5Server"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "dovecot-debuginfo-0:1.0.7-2.el5.ppc as a component of Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server:dovecot-debuginfo-0:1.0.7-2.el5.ppc"
},
"product_reference": "dovecot-debuginfo-0:1.0.7-2.el5.ppc",
"relates_to_product_reference": "5Server"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "dovecot-debuginfo-0:1.0.7-2.el5.s390x as a component of Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server:dovecot-debuginfo-0:1.0.7-2.el5.s390x"
},
"product_reference": "dovecot-debuginfo-0:1.0.7-2.el5.s390x",
"relates_to_product_reference": "5Server"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "dovecot-debuginfo-0:1.0.7-2.el5.x86_64 as a component of Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server:dovecot-debuginfo-0:1.0.7-2.el5.x86_64"
},
"product_reference": "dovecot-debuginfo-0:1.0.7-2.el5.x86_64",
"relates_to_product_reference": "5Server"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2007-2231",
"discovery_date": "2007-04-25T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "238439"
}
],
"notes": [
{
"category": "description",
"text": "Directory traversal vulnerability in index/mbox/mbox-storage.c in Dovecot before 1.0.rc29, when using the zlib plugin, allows remote attackers to read arbitrary gzipped (.gz) mailboxes (mbox files) via a .. (dot dot) sequence in the mailbox name.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Directory traversal in dovecot with zlib plugin",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This issue did not affect Red Hat Enterprise Linux prior to version 5.",
"title": "Statement"
}
],
"product_status": {
"fixed": [
"5Client-Workstation:dovecot-0:1.0.7-2.el5.i386",
"5Client-Workstation:dovecot-0:1.0.7-2.el5.ia64",
"5Client-Workstation:dovecot-0:1.0.7-2.el5.ppc",
"5Client-Workstation:dovecot-0:1.0.7-2.el5.s390x",
"5Client-Workstation:dovecot-0:1.0.7-2.el5.src",
"5Client-Workstation:dovecot-0:1.0.7-2.el5.x86_64",
"5Client-Workstation:dovecot-debuginfo-0:1.0.7-2.el5.i386",
"5Client-Workstation:dovecot-debuginfo-0:1.0.7-2.el5.ia64",
"5Client-Workstation:dovecot-debuginfo-0:1.0.7-2.el5.ppc",
"5Client-Workstation:dovecot-debuginfo-0:1.0.7-2.el5.s390x",
"5Client-Workstation:dovecot-debuginfo-0:1.0.7-2.el5.x86_64",
"5Server:dovecot-0:1.0.7-2.el5.i386",
"5Server:dovecot-0:1.0.7-2.el5.ia64",
"5Server:dovecot-0:1.0.7-2.el5.ppc",
"5Server:dovecot-0:1.0.7-2.el5.s390x",
"5Server:dovecot-0:1.0.7-2.el5.src",
"5Server:dovecot-0:1.0.7-2.el5.x86_64",
"5Server:dovecot-debuginfo-0:1.0.7-2.el5.i386",
"5Server:dovecot-debuginfo-0:1.0.7-2.el5.ia64",
"5Server:dovecot-debuginfo-0:1.0.7-2.el5.ppc",
"5Server:dovecot-debuginfo-0:1.0.7-2.el5.s390x",
"5Server:dovecot-debuginfo-0:1.0.7-2.el5.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2007-2231"
},
{
"category": "external",
"summary": "RHBZ#238439",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=238439"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2007-2231",
"url": "https://www.cve.org/CVERecord?id=CVE-2007-2231"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2007-2231",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2007-2231"
}
],
"release_date": "2007-03-28T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2008-05-20T14:28:00+00:00",
"details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied. \n\nThis update is available via Red Hat Network. Details on how to use \nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/FAQ_58_10188",
"product_ids": [
"5Client-Workstation:dovecot-0:1.0.7-2.el5.i386",
"5Client-Workstation:dovecot-0:1.0.7-2.el5.ia64",
"5Client-Workstation:dovecot-0:1.0.7-2.el5.ppc",
"5Client-Workstation:dovecot-0:1.0.7-2.el5.s390x",
"5Client-Workstation:dovecot-0:1.0.7-2.el5.src",
"5Client-Workstation:dovecot-0:1.0.7-2.el5.x86_64",
"5Client-Workstation:dovecot-debuginfo-0:1.0.7-2.el5.i386",
"5Client-Workstation:dovecot-debuginfo-0:1.0.7-2.el5.ia64",
"5Client-Workstation:dovecot-debuginfo-0:1.0.7-2.el5.ppc",
"5Client-Workstation:dovecot-debuginfo-0:1.0.7-2.el5.s390x",
"5Client-Workstation:dovecot-debuginfo-0:1.0.7-2.el5.x86_64",
"5Server:dovecot-0:1.0.7-2.el5.i386",
"5Server:dovecot-0:1.0.7-2.el5.ia64",
"5Server:dovecot-0:1.0.7-2.el5.ppc",
"5Server:dovecot-0:1.0.7-2.el5.s390x",
"5Server:dovecot-0:1.0.7-2.el5.src",
"5Server:dovecot-0:1.0.7-2.el5.x86_64",
"5Server:dovecot-debuginfo-0:1.0.7-2.el5.i386",
"5Server:dovecot-debuginfo-0:1.0.7-2.el5.ia64",
"5Server:dovecot-debuginfo-0:1.0.7-2.el5.ppc",
"5Server:dovecot-debuginfo-0:1.0.7-2.el5.s390x",
"5Server:dovecot-debuginfo-0:1.0.7-2.el5.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2008:0297"
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "Directory traversal in dovecot with zlib plugin"
},
{
"cve": "CVE-2007-4211",
"discovery_date": "2007-08-03T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "251007"
}
],
"notes": [
{
"category": "description",
"text": "The ACL plugin in Dovecot before 1.0.3 allows remote authenticated users with the insert right to save certain flags via a (1) COPY or (2) APPEND command.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Dovecot possible privilege ascalation in ACL plugin",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "These issues did not affect the dovecot versions as shipped with Red Hat Enterprise Linux 2.1, 3, or 4.",
"title": "Statement"
}
],
"product_status": {
"fixed": [
"5Client-Workstation:dovecot-0:1.0.7-2.el5.i386",
"5Client-Workstation:dovecot-0:1.0.7-2.el5.ia64",
"5Client-Workstation:dovecot-0:1.0.7-2.el5.ppc",
"5Client-Workstation:dovecot-0:1.0.7-2.el5.s390x",
"5Client-Workstation:dovecot-0:1.0.7-2.el5.src",
"5Client-Workstation:dovecot-0:1.0.7-2.el5.x86_64",
"5Client-Workstation:dovecot-debuginfo-0:1.0.7-2.el5.i386",
"5Client-Workstation:dovecot-debuginfo-0:1.0.7-2.el5.ia64",
"5Client-Workstation:dovecot-debuginfo-0:1.0.7-2.el5.ppc",
"5Client-Workstation:dovecot-debuginfo-0:1.0.7-2.el5.s390x",
"5Client-Workstation:dovecot-debuginfo-0:1.0.7-2.el5.x86_64",
"5Server:dovecot-0:1.0.7-2.el5.i386",
"5Server:dovecot-0:1.0.7-2.el5.ia64",
"5Server:dovecot-0:1.0.7-2.el5.ppc",
"5Server:dovecot-0:1.0.7-2.el5.s390x",
"5Server:dovecot-0:1.0.7-2.el5.src",
"5Server:dovecot-0:1.0.7-2.el5.x86_64",
"5Server:dovecot-debuginfo-0:1.0.7-2.el5.i386",
"5Server:dovecot-debuginfo-0:1.0.7-2.el5.ia64",
"5Server:dovecot-debuginfo-0:1.0.7-2.el5.ppc",
"5Server:dovecot-debuginfo-0:1.0.7-2.el5.s390x",
"5Server:dovecot-debuginfo-0:1.0.7-2.el5.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2007-4211"
},
{
"category": "external",
"summary": "RHBZ#251007",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=251007"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2007-4211",
"url": "https://www.cve.org/CVERecord?id=CVE-2007-4211"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2007-4211",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2007-4211"
}
],
"release_date": "2007-08-01T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2008-05-20T14:28:00+00:00",
"details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied. \n\nThis update is available via Red Hat Network. Details on how to use \nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/FAQ_58_10188",
"product_ids": [
"5Client-Workstation:dovecot-0:1.0.7-2.el5.i386",
"5Client-Workstation:dovecot-0:1.0.7-2.el5.ia64",
"5Client-Workstation:dovecot-0:1.0.7-2.el5.ppc",
"5Client-Workstation:dovecot-0:1.0.7-2.el5.s390x",
"5Client-Workstation:dovecot-0:1.0.7-2.el5.src",
"5Client-Workstation:dovecot-0:1.0.7-2.el5.x86_64",
"5Client-Workstation:dovecot-debuginfo-0:1.0.7-2.el5.i386",
"5Client-Workstation:dovecot-debuginfo-0:1.0.7-2.el5.ia64",
"5Client-Workstation:dovecot-debuginfo-0:1.0.7-2.el5.ppc",
"5Client-Workstation:dovecot-debuginfo-0:1.0.7-2.el5.s390x",
"5Client-Workstation:dovecot-debuginfo-0:1.0.7-2.el5.x86_64",
"5Server:dovecot-0:1.0.7-2.el5.i386",
"5Server:dovecot-0:1.0.7-2.el5.ia64",
"5Server:dovecot-0:1.0.7-2.el5.ppc",
"5Server:dovecot-0:1.0.7-2.el5.s390x",
"5Server:dovecot-0:1.0.7-2.el5.src",
"5Server:dovecot-0:1.0.7-2.el5.x86_64",
"5Server:dovecot-debuginfo-0:1.0.7-2.el5.i386",
"5Server:dovecot-debuginfo-0:1.0.7-2.el5.ia64",
"5Server:dovecot-debuginfo-0:1.0.7-2.el5.ppc",
"5Server:dovecot-debuginfo-0:1.0.7-2.el5.s390x",
"5Server:dovecot-debuginfo-0:1.0.7-2.el5.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2008:0297"
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "Dovecot possible privilege ascalation in ACL plugin"
},
{
"cve": "CVE-2007-6598",
"discovery_date": "2007-12-29T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "427575"
}
],
"notes": [
{
"category": "description",
"text": "Dovecot before 1.0.10, with certain configuration options including use of %variables, does not properly maintain the LDAP+auth cache, which might allow remote authenticated users to login as a different user who has the same password.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "dovecot LDAP+auth cache user login mixup",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This issue did not affect versions of Dovecot as shipped with Red Hat Enterprise Linux before version 5.",
"title": "Statement"
}
],
"product_status": {
"fixed": [
"5Client-Workstation:dovecot-0:1.0.7-2.el5.i386",
"5Client-Workstation:dovecot-0:1.0.7-2.el5.ia64",
"5Client-Workstation:dovecot-0:1.0.7-2.el5.ppc",
"5Client-Workstation:dovecot-0:1.0.7-2.el5.s390x",
"5Client-Workstation:dovecot-0:1.0.7-2.el5.src",
"5Client-Workstation:dovecot-0:1.0.7-2.el5.x86_64",
"5Client-Workstation:dovecot-debuginfo-0:1.0.7-2.el5.i386",
"5Client-Workstation:dovecot-debuginfo-0:1.0.7-2.el5.ia64",
"5Client-Workstation:dovecot-debuginfo-0:1.0.7-2.el5.ppc",
"5Client-Workstation:dovecot-debuginfo-0:1.0.7-2.el5.s390x",
"5Client-Workstation:dovecot-debuginfo-0:1.0.7-2.el5.x86_64",
"5Server:dovecot-0:1.0.7-2.el5.i386",
"5Server:dovecot-0:1.0.7-2.el5.ia64",
"5Server:dovecot-0:1.0.7-2.el5.ppc",
"5Server:dovecot-0:1.0.7-2.el5.s390x",
"5Server:dovecot-0:1.0.7-2.el5.src",
"5Server:dovecot-0:1.0.7-2.el5.x86_64",
"5Server:dovecot-debuginfo-0:1.0.7-2.el5.i386",
"5Server:dovecot-debuginfo-0:1.0.7-2.el5.ia64",
"5Server:dovecot-debuginfo-0:1.0.7-2.el5.ppc",
"5Server:dovecot-debuginfo-0:1.0.7-2.el5.s390x",
"5Server:dovecot-debuginfo-0:1.0.7-2.el5.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2007-6598"
},
{
"category": "external",
"summary": "RHBZ#427575",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=427575"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2007-6598",
"url": "https://www.cve.org/CVERecord?id=CVE-2007-6598"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2007-6598",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2007-6598"
}
],
"release_date": "2007-12-29T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2008-05-20T14:28:00+00:00",
"details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied. \n\nThis update is available via Red Hat Network. Details on how to use \nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/FAQ_58_10188",
"product_ids": [
"5Client-Workstation:dovecot-0:1.0.7-2.el5.i386",
"5Client-Workstation:dovecot-0:1.0.7-2.el5.ia64",
"5Client-Workstation:dovecot-0:1.0.7-2.el5.ppc",
"5Client-Workstation:dovecot-0:1.0.7-2.el5.s390x",
"5Client-Workstation:dovecot-0:1.0.7-2.el5.src",
"5Client-Workstation:dovecot-0:1.0.7-2.el5.x86_64",
"5Client-Workstation:dovecot-debuginfo-0:1.0.7-2.el5.i386",
"5Client-Workstation:dovecot-debuginfo-0:1.0.7-2.el5.ia64",
"5Client-Workstation:dovecot-debuginfo-0:1.0.7-2.el5.ppc",
"5Client-Workstation:dovecot-debuginfo-0:1.0.7-2.el5.s390x",
"5Client-Workstation:dovecot-debuginfo-0:1.0.7-2.el5.x86_64",
"5Server:dovecot-0:1.0.7-2.el5.i386",
"5Server:dovecot-0:1.0.7-2.el5.ia64",
"5Server:dovecot-0:1.0.7-2.el5.ppc",
"5Server:dovecot-0:1.0.7-2.el5.s390x",
"5Server:dovecot-0:1.0.7-2.el5.src",
"5Server:dovecot-0:1.0.7-2.el5.x86_64",
"5Server:dovecot-debuginfo-0:1.0.7-2.el5.i386",
"5Server:dovecot-debuginfo-0:1.0.7-2.el5.ia64",
"5Server:dovecot-debuginfo-0:1.0.7-2.el5.ppc",
"5Server:dovecot-debuginfo-0:1.0.7-2.el5.s390x",
"5Server:dovecot-debuginfo-0:1.0.7-2.el5.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2008:0297"
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "dovecot LDAP+auth cache user login mixup"
},
{
"cve": "CVE-2008-1199",
"discovery_date": "2008-03-01T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "436927"
}
],
"notes": [
{
"category": "description",
"text": "Dovecot before 1.0.11, when configured to use mail_extra_groups to allow Dovecot to create dotlocks in /var/mail, might allow local users to read sensitive mail files for other users, or modify files or directories that are writable by group, via a symlink attack.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "dovecot: insecure mail_extra_groups option",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This issue does not affect the default configuration of Dovecot as shipped in Red Hat Enterprise Linux.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"5Client-Workstation:dovecot-0:1.0.7-2.el5.i386",
"5Client-Workstation:dovecot-0:1.0.7-2.el5.ia64",
"5Client-Workstation:dovecot-0:1.0.7-2.el5.ppc",
"5Client-Workstation:dovecot-0:1.0.7-2.el5.s390x",
"5Client-Workstation:dovecot-0:1.0.7-2.el5.src",
"5Client-Workstation:dovecot-0:1.0.7-2.el5.x86_64",
"5Client-Workstation:dovecot-debuginfo-0:1.0.7-2.el5.i386",
"5Client-Workstation:dovecot-debuginfo-0:1.0.7-2.el5.ia64",
"5Client-Workstation:dovecot-debuginfo-0:1.0.7-2.el5.ppc",
"5Client-Workstation:dovecot-debuginfo-0:1.0.7-2.el5.s390x",
"5Client-Workstation:dovecot-debuginfo-0:1.0.7-2.el5.x86_64",
"5Server:dovecot-0:1.0.7-2.el5.i386",
"5Server:dovecot-0:1.0.7-2.el5.ia64",
"5Server:dovecot-0:1.0.7-2.el5.ppc",
"5Server:dovecot-0:1.0.7-2.el5.s390x",
"5Server:dovecot-0:1.0.7-2.el5.src",
"5Server:dovecot-0:1.0.7-2.el5.x86_64",
"5Server:dovecot-debuginfo-0:1.0.7-2.el5.i386",
"5Server:dovecot-debuginfo-0:1.0.7-2.el5.ia64",
"5Server:dovecot-debuginfo-0:1.0.7-2.el5.ppc",
"5Server:dovecot-debuginfo-0:1.0.7-2.el5.s390x",
"5Server:dovecot-debuginfo-0:1.0.7-2.el5.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2008-1199"
},
{
"category": "external",
"summary": "RHBZ#436927",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=436927"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2008-1199",
"url": "https://www.cve.org/CVERecord?id=CVE-2008-1199"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2008-1199",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2008-1199"
}
],
"release_date": "2008-03-04T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2008-05-20T14:28:00+00:00",
"details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied. \n\nThis update is available via Red Hat Network. Details on how to use \nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/FAQ_58_10188",
"product_ids": [
"5Client-Workstation:dovecot-0:1.0.7-2.el5.i386",
"5Client-Workstation:dovecot-0:1.0.7-2.el5.ia64",
"5Client-Workstation:dovecot-0:1.0.7-2.el5.ppc",
"5Client-Workstation:dovecot-0:1.0.7-2.el5.s390x",
"5Client-Workstation:dovecot-0:1.0.7-2.el5.src",
"5Client-Workstation:dovecot-0:1.0.7-2.el5.x86_64",
"5Client-Workstation:dovecot-debuginfo-0:1.0.7-2.el5.i386",
"5Client-Workstation:dovecot-debuginfo-0:1.0.7-2.el5.ia64",
"5Client-Workstation:dovecot-debuginfo-0:1.0.7-2.el5.ppc",
"5Client-Workstation:dovecot-debuginfo-0:1.0.7-2.el5.s390x",
"5Client-Workstation:dovecot-debuginfo-0:1.0.7-2.el5.x86_64",
"5Server:dovecot-0:1.0.7-2.el5.i386",
"5Server:dovecot-0:1.0.7-2.el5.ia64",
"5Server:dovecot-0:1.0.7-2.el5.ppc",
"5Server:dovecot-0:1.0.7-2.el5.s390x",
"5Server:dovecot-0:1.0.7-2.el5.src",
"5Server:dovecot-0:1.0.7-2.el5.x86_64",
"5Server:dovecot-debuginfo-0:1.0.7-2.el5.i386",
"5Server:dovecot-debuginfo-0:1.0.7-2.el5.ia64",
"5Server:dovecot-debuginfo-0:1.0.7-2.el5.ppc",
"5Server:dovecot-debuginfo-0:1.0.7-2.el5.s390x",
"5Server:dovecot-debuginfo-0:1.0.7-2.el5.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2008:0297"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "HIGH",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 3.7,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:L/AC:H/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"products": [
"5Client-Workstation:dovecot-0:1.0.7-2.el5.i386",
"5Client-Workstation:dovecot-0:1.0.7-2.el5.ia64",
"5Client-Workstation:dovecot-0:1.0.7-2.el5.ppc",
"5Client-Workstation:dovecot-0:1.0.7-2.el5.s390x",
"5Client-Workstation:dovecot-0:1.0.7-2.el5.src",
"5Client-Workstation:dovecot-0:1.0.7-2.el5.x86_64",
"5Client-Workstation:dovecot-debuginfo-0:1.0.7-2.el5.i386",
"5Client-Workstation:dovecot-debuginfo-0:1.0.7-2.el5.ia64",
"5Client-Workstation:dovecot-debuginfo-0:1.0.7-2.el5.ppc",
"5Client-Workstation:dovecot-debuginfo-0:1.0.7-2.el5.s390x",
"5Client-Workstation:dovecot-debuginfo-0:1.0.7-2.el5.x86_64",
"5Server:dovecot-0:1.0.7-2.el5.i386",
"5Server:dovecot-0:1.0.7-2.el5.ia64",
"5Server:dovecot-0:1.0.7-2.el5.ppc",
"5Server:dovecot-0:1.0.7-2.el5.s390x",
"5Server:dovecot-0:1.0.7-2.el5.src",
"5Server:dovecot-0:1.0.7-2.el5.x86_64",
"5Server:dovecot-debuginfo-0:1.0.7-2.el5.i386",
"5Server:dovecot-debuginfo-0:1.0.7-2.el5.ia64",
"5Server:dovecot-debuginfo-0:1.0.7-2.el5.ppc",
"5Server:dovecot-debuginfo-0:1.0.7-2.el5.s390x",
"5Server:dovecot-debuginfo-0:1.0.7-2.el5.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "dovecot: insecure mail_extra_groups option"
}
]
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…