CVE-2011-1929

lib-mail/message-header-parser.c in Dovecot 1.2.x before 1.2.17 and 2.0.x before 2.0.13 does not properly handle '\0' characters in header names, which allows remote attackers to cause a denial of service (daemon crash or mailbox corruption) via a crafted e-mail message.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
5 UNKNOWN
NETWORK
LOW
AV:N/AC:L/Au:N/C:N/I:N/A:P
redhatCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 90%
VendorProductVersion
dovecotdovecot
1.2.0
dovecotdovecot
1.2.1
dovecotdovecot
1.2.2
dovecotdovecot
1.2.3
dovecotdovecot
1.2.4
dovecotdovecot
1.2.5
dovecotdovecot
1.2.6
dovecotdovecot
1.2.7
dovecotdovecot
1.2.8
dovecotdovecot
1.2.9
dovecotdovecot
1.2.10
dovecotdovecot
1.2.11
dovecotdovecot
1.2.12
dovecotdovecot
1.2.13
dovecotdovecot
1.2.14
dovecotdovecot
1.2.15
dovecotdovecot
1.2.16
dovecotdovecot
2.0:beta1
dovecotdovecot
2.0.0
dovecotdovecot
2.0.1
dovecotdovecot
2.0.2
dovecotdovecot
2.0.3
dovecotdovecot
2.0.4
dovecotdovecot
2.0.5
dovecotdovecot
2.0.6
dovecotdovecot
2.0.7
dovecotdovecot
2.0.8
dovecotdovecot
2.0.9
dovecotdovecot
2.0.10
dovecotdovecot
2.0.11
dovecotdovecot
2.0.12
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
dovecot
bullseye
1:2.3.13+dfsg1-2+deb11u1
fixed
lenny
not-affected
bullseye (security)
1:2.3.13+dfsg1-2+deb11u2
fixed
bookworm
1:2.3.19.1+dfsg1-2.1+deb12u1
fixed
bookworm (security)
1:2.3.19.1+dfsg1-2.1+deb12u1
fixed
sid
1:2.3.21.1+dfsg1-1
fixed
trixie
1:2.3.21.1+dfsg1-1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
dovecot
natty
Fixed 1:1.2.15-3ubuntu2.1
released
maverick
Fixed 1:1.2.12-1ubuntu8.2
released
lucid
Fixed 1:1.2.9-1ubuntu6.4
released
hardy
not-affected
dapper
ignored
Common Weakness Enumeration
References
http://dovecot.org/pipermail/dovecot/2011-May/059085.html
http://dovecot.org/pipermail/dovecot/2011-May/059086.html
http://hg.dovecot.org/dovecot-1.1/rev/3698dfe0f21c
http://lists.fedoraproject.org/pipermail/package-announce/2011-June/061384.html
http://lists.fedoraproject.org/pipermail/package-announce/2011-May/060815.html
http://lists.fedoraproject.org/pipermail/package-announce/2011-May/060825.html
http://openwall.com/lists/oss-security/2011/05/18/4
http://openwall.com/lists/oss-security/2011/05/19/3
http://openwall.com/lists/oss-security/2011/05/19/6
http://osvdb.org/72495
http://secunia.com/advisories/44683
http://secunia.com/advisories/44712
http://secunia.com/advisories/44756
http://secunia.com/advisories/44771
http://secunia.com/advisories/44827
http://www.debian.org/security/2011/dsa-2252
http://www.dovecot.org/doc/NEWS-1.2
http://www.dovecot.org/doc/NEWS-2.0
http://www.mandriva.com/security/advisories?name=MDVSA-2011:101
http://www.redhat.com/support/errata/RHSA-2011-1187.html
http://www.securityfocus.com/bid/47930
http://www.ubuntu.com/usn/USN-1143-1
https://bugzilla.redhat.com/show_bug.cgi?id=706286
https://exchange.xforce.ibmcloud.com/vulnerabilities/67589
https://hermes.opensuse.org/messages/8581790
http://dovecot.org/pipermail/dovecot/2011-May/059085.html
http://dovecot.org/pipermail/dovecot/2011-May/059086.html
http://hg.dovecot.org/dovecot-1.1/rev/3698dfe0f21c
http://lists.fedoraproject.org/pipermail/package-announce/2011-June/061384.html
http://lists.fedoraproject.org/pipermail/package-announce/2011-May/060815.html
http://lists.fedoraproject.org/pipermail/package-announce/2011-May/060825.html
http://openwall.com/lists/oss-security/2011/05/18/4
http://openwall.com/lists/oss-security/2011/05/19/3
http://openwall.com/lists/oss-security/2011/05/19/6
http://osvdb.org/72495
http://secunia.com/advisories/44683
http://secunia.com/advisories/44712
http://secunia.com/advisories/44756
http://secunia.com/advisories/44771
http://secunia.com/advisories/44827
http://www.debian.org/security/2011/dsa-2252
http://www.dovecot.org/doc/NEWS-1.2
http://www.dovecot.org/doc/NEWS-2.0
http://www.mandriva.com/security/advisories?name=MDVSA-2011:101
http://www.redhat.com/support/errata/RHSA-2011-1187.html
http://www.securityfocus.com/bid/47930
http://www.ubuntu.com/usn/USN-1143-1
https://bugzilla.redhat.com/show_bug.cgi?id=706286
https://exchange.xforce.ibmcloud.com/vulnerabilities/67589
https://hermes.opensuse.org/messages/8581790