dovecot22 (SUSE:Linux Enterprise Server for SAP Applications 12 SP1) — known CVEs & security advisories

Known CVE vulnerabilities and GitHub Security Advisories affecting the SUSE:Linux Enterprise Server for SAP Applications 12 SP1 package dovecot22, with affected version ranges, CVSS severity, EPSS exploit prediction, and CISA KEV status.

CVEs (6)

• CVE-2019-11500 — CVSS 9.8 (critical): In Dovecot before 2.2.36.4 and 2.3.x before 2.3.7.2 (and Pigeonhole before 0.5.7.2), protocol processing can fail for quoted strings. This…
• CVE-2019-7524 — CVSS 8.8 (high): In Dovecot before 2.2.36.3 and 2.3.x before 2.3.5.1, a local attacker can cause a buffer overflow in the indexer-worker process, which can…
• CVE-2019-3814 — CVSS 7.7 (high): It was discovered that Dovecot before versions 2.2.36.1 and 2.3.4.1 incorrectly handled client certificates. A remote attacker in…
• CVE-2017-15130 — CVSS 5.9 (medium): A denial of service flaw was found in dovecot before 2.2.34. An attacker able to generate random SNI server names could exploit TLS SNI…
• CVE-2017-2669 — CVSS 3.7 (low): Dovecot before version 2.2.29 is vulnerable to a denial of service. When 'dict' passdb and userdb were used for user authentication, the…
• CVE-2016-4983 — CVSS 3.3 (low): A postinstall script in the dovecot rpm allows local users to read the contents of newly created SSL/TLS key files.