CVE-2011-1929

lib-mail/message-header-parser.c in Dovecot 1.2.x before 1.2.17 and 2.0.x before 2.0.13 does not properly handle '\0' characters in header names, which allows remote attackers to cause a denial of service (daemon crash or mailbox corruption) via a crafted e-mail message.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
5 UNKNOWN
NETWORK
LOW
AV:N/AC:L/Au:N/C:N/I:N/A:P
Base Score
CVSS 3.x
EPSS Score
Percentile: 89%
Affected Products (NVD)
VendorProductVersion
dovecotdovecot
1.2.0
dovecotdovecot
1.2.1
dovecotdovecot
1.2.2
dovecotdovecot
1.2.3
dovecotdovecot
1.2.4
dovecotdovecot
1.2.5
dovecotdovecot
1.2.6
dovecotdovecot
1.2.7
dovecotdovecot
1.2.8
dovecotdovecot
1.2.9
dovecotdovecot
1.2.10
dovecotdovecot
1.2.11
dovecotdovecot
1.2.12
dovecotdovecot
1.2.13
dovecotdovecot
1.2.14
dovecotdovecot
1.2.15
dovecotdovecot
1.2.16
dovecotdovecot
2.0:beta1
dovecotdovecot
2.0.0
dovecotdovecot
2.0.1
dovecotdovecot
2.0.2
dovecotdovecot
2.0.3
dovecotdovecot
2.0.4
dovecotdovecot
2.0.5
dovecotdovecot
2.0.6
dovecotdovecot
2.0.7
dovecotdovecot
2.0.8
dovecotdovecot
2.0.9
dovecotdovecot
2.0.10
dovecotdovecot
2.0.11
dovecotdovecot
2.0.12
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
dovecot
bookworm
1:2.3.19.1+dfsg1-2.1+deb12u1
fixed
bookworm (security)
1:2.3.19.1+dfsg1-2.1+deb12u1
fixed
bullseye
1:2.3.13+dfsg1-2+deb11u1
fixed
bullseye (security)
1:2.3.13+dfsg1-2+deb11u2
fixed
lenny
not-affected
sid
1:2.3.21.1+dfsg1-1
fixed
trixie
1:2.3.21.1+dfsg1-1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
dovecot
dapper
ignored
hardy
not-affected
lucid
Fixed 1:1.2.9-1ubuntu6.4
released
maverick
Fixed 1:1.2.12-1ubuntu8.2
released
natty
Fixed 1:1.2.15-3ubuntu2.1
released
Red Hat logo
Red Hat Enterprise Linux Releases
Red Hat Product
Release
dovecot
RHEL 6
1:2.0.9-2.el6_1.1
fixed
dovecot-devel
RHEL 6
1:2.0.9-2.el6_1.1
fixed
dovecot-mysql
RHEL 6
1:2.0.9-2.el6_1.1
fixed
dovecot-pgsql
RHEL 6
1:2.0.9-2.el6_1.1
fixed
dovecot-pigeonhole
RHEL 6
1:2.0.9-2.el6_1.1
fixed
Common Weakness Enumeration
References
http://dovecot.org/pipermail/dovecot/2011-May/059085.html
http://dovecot.org/pipermail/dovecot/2011-May/059086.html
http://hg.dovecot.org/dovecot-1.1/rev/3698dfe0f21c
http://lists.fedoraproject.org/pipermail/package-announce/2011-June/061384.html
http://lists.fedoraproject.org/pipermail/package-announce/2011-May/060815.html
http://lists.fedoraproject.org/pipermail/package-announce/2011-May/060825.html
http://openwall.com/lists/oss-security/2011/05/18/4
http://openwall.com/lists/oss-security/2011/05/19/3
http://openwall.com/lists/oss-security/2011/05/19/6
http://osvdb.org/72495
http://secunia.com/advisories/44683
http://secunia.com/advisories/44712
http://secunia.com/advisories/44756
http://secunia.com/advisories/44771
http://secunia.com/advisories/44827
http://www.debian.org/security/2011/dsa-2252
http://www.dovecot.org/doc/NEWS-1.2
http://www.dovecot.org/doc/NEWS-2.0
http://www.mandriva.com/security/advisories?name=MDVSA-2011:101
http://www.redhat.com/support/errata/RHSA-2011-1187.html
http://www.securityfocus.com/bid/47930
http://www.ubuntu.com/usn/USN-1143-1
https://bugzilla.redhat.com/show_bug.cgi?id=706286
https://exchange.xforce.ibmcloud.com/vulnerabilities/67589
https://hermes.opensuse.org/messages/8581790
http://dovecot.org/pipermail/dovecot/2011-May/059085.html
http://dovecot.org/pipermail/dovecot/2011-May/059086.html
http://hg.dovecot.org/dovecot-1.1/rev/3698dfe0f21c
http://lists.fedoraproject.org/pipermail/package-announce/2011-June/061384.html
http://lists.fedoraproject.org/pipermail/package-announce/2011-May/060815.html
http://lists.fedoraproject.org/pipermail/package-announce/2011-May/060825.html
http://openwall.com/lists/oss-security/2011/05/18/4
http://openwall.com/lists/oss-security/2011/05/19/3
http://openwall.com/lists/oss-security/2011/05/19/6
http://osvdb.org/72495
http://secunia.com/advisories/44683
http://secunia.com/advisories/44712
http://secunia.com/advisories/44756
http://secunia.com/advisories/44771
http://secunia.com/advisories/44827
http://www.debian.org/security/2011/dsa-2252
http://www.dovecot.org/doc/NEWS-1.2
http://www.dovecot.org/doc/NEWS-2.0
http://www.mandriva.com/security/advisories?name=MDVSA-2011:101
http://www.redhat.com/support/errata/RHSA-2011-1187.html
http://www.securityfocus.com/bid/47930
http://www.ubuntu.com/usn/USN-1143-1
https://bugzilla.redhat.com/show_bug.cgi?id=706286
https://exchange.xforce.ibmcloud.com/vulnerabilities/67589
https://hermes.opensuse.org/messages/8581790