dovecot23 (SUSE:Linux Enterprise Module for Server Applications 15 SP1) — known CVEs & security advisories

Known CVE vulnerabilities and GitHub Security Advisories affecting the SUSE:Linux Enterprise Module for Server Applications 15 SP1 package dovecot23, with affected version ranges, CVSS severity, EPSS exploit prediction, and CISA KEV status.

CVEs (11)

• CVE-2019-11500 — CVSS 9.8 (critical): In Dovecot before 2.2.36.4 and 2.3.x before 2.3.7.2 (and Pigeonhole before 0.5.7.2), protocol processing can fail for quoted strings. This…
• CVE-2019-11499 — CVSS 7.5 (high): In the IMAP Server in Dovecot 2.3.3 through 2.3.5.2, the submission-login component crashes if AUTH PLAIN is attempted over a TLS secured…
• CVE-2020-10957 — CVSS 7.5 (high): In Dovecot before 2.3.10.1, unauthenticated sending of malformed parameters to a NOOP command causes a NULL Pointer Dereference and crash…
• CVE-2019-11494 — CVSS 7.5 (high): In the IMAP Server in Dovecot 2.3.3 through 2.3.5.2, the submission-login service crashes when the client disconnects prematurely during…
• CVE-2020-12673 — CVSS 7.5 (high): In Dovecot before 2.3.11.3, sending a specially formatted NTLM request will crash the auth service because of an out-of-bounds read.
• CVE-2020-12674 — CVSS 7.5 (high): In Dovecot before 2.3.11.3, sending a specially formatted RPA request will crash the auth service because a length of zero is mishandled.
• CVE-2020-25275 — CVSS 7.5 (high): Dovecot before 2.3.13 has Improper Input Validation in lda, lmtp, and imap, leading to an application crash via a crafted email message…
• CVE-2020-12100 — CVSS 7.5 (high): In Dovecot before 2.3.11.3, uncontrolled recursion in submission, lmtp, and lda allows remote attackers to cause a denial of service…
• CVE-2020-24386 — CVSS 6.8 (medium): An issue was discovered in Dovecot before 2.3.13. By using IMAP IDLE, an authenticated attacker can trigger unhibernation via…
• CVE-2020-10958 — CVSS 5.3 (medium): In Dovecot before 2.3.10.1, a crafted SMTP/LMTP message triggers an unauthenticated use-after-free bug in submission-login, submission, or…
• CVE-2020-10967 — CVSS 5.3 (medium): In Dovecot before 2.3.10.1, remote unauthenticated attackers can crash the lmtp or submission process by sending mail with an empty…