CVE-2017-14461 | BDVDB-2026-97331 Detail
The Dovecot ProjectDovecot
Description#
A specially crafted email delivered over SMTP and passed on to Dovecot by MTA can trigger an out of bounds read resulting in potential sensitive information disclosure and denial of service. In order to trigger this vulnerability, an attacker needs to send a specially crafted email message to the server.
Impact#
Per CVSS v3.0: confidentiality impact low, integrity impact none, availability impact high. Attack vector: network.
Weaknesses#
- CWE-125 Out-of-bounds Read
References#
- https://usn.ubuntu.com/3587-1/
- https://lists.debian.org/debian-lts-announce/2018/03/msg00036.html
- https://www.debian.org/security/2018/dsa-4130
- https://usn.ubuntu.com/3587-2/
- http://www.securityfocus.com/bid/103201
- https://www.dovecot.org/list/dovecot-news/2018-February/000370.html
- https://talosintelligence.com/vulnerability_reports/TALOS-2017-0510
Exploit#
No public exploit known
History#
- Version 1Record published in the CVE List.
- Version 2Most recent update recorded in the CVE List.