CVE-2020-10958
Published: 18 May 2020
In Dovecot before 2.3.10.1, a crafted SMTP/LMTP message triggers an unauthenticated use-after-free bug in submission-login, submission, or lmtp, and can lead to a crash under circumstances involving many newlines after a command.
Priority
Medium
CVSS 3 base score: 5.3
Status
| Package | Release | Status |
|---|---|---|
|
dovecot Launchpad, Ubuntu, Debian |
Upstream |
Needs triage
|
| Ubuntu 20.10 (Groovy Gorilla) |
Released
(1:2.3.7.2-1ubuntu4)
|
|
| Ubuntu 20.04 LTS (Focal Fossa) |
Released
(1:2.3.7.2-1ubuntu3.1)
|
|
| Ubuntu 18.04 LTS (Bionic Beaver) |
Not vulnerable
(1:2.2.33.2-1ubuntu4.5)
|
|
| Ubuntu 16.04 LTS (Xenial Xerus) |
Not vulnerable
(1:2.2.22-1ubuntu2.12)
|
|
| Ubuntu 14.04 ESM (Trusty Tahr) |
Not vulnerable
(1:2.2.9-1ubuntu2.6+esm2)
|
Notes
| Author | Note |
|---|---|
| amurray | According to upstream, versions from 2.3.0 to 2.3.10 are affected |