CVE-2017-14461

Common vulnerabilities & exposures (CVE)

CVE database CVE database blogpost Release & EoL database

Published at: - 02-03-2018 04:29

Last modified: - 19-04-2022 09:15

Total changes: - 4

Description

A specially crafted email delivered over SMTP and passed on to Dovecot by MTA can trigger an out of bounds read resulting in potential sensitive information disclosure and denial of service. In order to trigger this vulnerability, an attacker needs to send a specially crafted email message to the server.

Common Vulnerability Scoring System (CVSS)

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H

Low

Attack complexity

Network

Attack vector

High

Availability

Low

Confidentiality

None

Integrity

Low

Privileges required

Unchanged

Scope

None

User interaction

7.1

Base score

2.8

4.2

Exploitability score

Impact score

Verification logic

vendor=dovecot AND product=dovecot AND version=2.2.33.2

vendor=Debian AND product=debian_linux AND version=8.0

vendor=Debian AND product=debian_linux AND version=9.0

vendor=Ubuntu AND product=Ubuntu AND version=14.04 AND software_edition=lts

vendor=Ubuntu AND product=Ubuntu AND version=16.04 AND software_edition=lts

vendor=Ubuntu AND product=Ubuntu AND version=17.10

Reference

[dovecot-news] 20180228 v2.2.34 released-Issue Tracking, Vendor Advisory
https://talosintelligence.com/vulnerability_reports/TALOS-2017-0510
DSA-4130-Third Party Advisory
103201-Third Party Advisory, VDB Entry
USN-3587-1-Patch, Third Party Advisory
[debian-lts-announce] 20180331 [SECURITY] [DLA 1333-1] dovecot security update-
USN-3587-2-

Keywords

CVE-2017-14461

Common vulnerabilities & exposures (CVE)

Description

Common Vulnerability Scoring System (CVSS)

Verification logic

Reference

NVD

CVE-2017-14461

CVE

Common vulnerabilities & exposures

CVSS

Common vulnerability scoring system

Security

Vulnerabilities

Exposures