← Back

Dovecot

dovecot

Vendor: Dovecot • 69 CVEs

CVEs (69)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2008-4907
1Dovecot
1Dovecot
Apr 23, 2026
Nov 4, 2008
N/A· v4
N/A· v3
4.3 MEDIUM· v2
The message parsing feature in Dovecot 1.1.4 and 1.1.5, when using the FETCH ENVELOPE command in the IMAP client, allows remote attackers to cause a denial of service (persistent crash) via an email with a malformed From...Show more
The message parsing feature in Dovecot 1.1.4 and 1.1.5, when using the FETCH ENVELOPE command in the IMAP client, allows remote attackers to cause a denial of service (persistent crash) via an email with a malformed From address, which triggers an assertion error, aka "invalid message address parsing bug."Show less
CVE-2008-4870
1Dovecot
1Dovecot
Apr 23, 2026
Nov 1, 2008
N/A· v4
N/A· v3
2.1 LOW· v2
dovecot 1.0.7 in Red Hat Enterprise Linux (RHEL) 5, and possibly Fedora, uses world-readable permissions for dovecot.conf, which allows local users to obtain the ssl_key_password parameter value.
CVE-2008-4578
1Dovecot
1Dovecot
Apr 23, 2026
Oct 15, 2008
N/A· v4
N/A· v3
5.0 MEDIUM· v2
The ACL plugin in Dovecot before 1.1.4 allows attackers to bypass intended access restrictions by using the "k" right to create unauthorized "parent/child/child" mailboxes.
CVE-2008-4577
4Canonical
DovecotFedoraproject+1 more
4Dovecot
FedoraOpensuse+1 more
Apr 23, 2026
Oct 15, 2008
N/A· v4
7.5 HIGH· v3
6.4 MEDIUM· v2
The ACL plugin in Dovecot before 1.1.4 treats negative access rights as if they are positive access rights, which allows attackers to bypass intended access restrictions.
CVE-2008-1218
1Dovecot
1Dovecot
Apr 23, 2026
Mar 10, 2008
N/A· v4
N/A· v3
6.8 MEDIUM· v2
Argument injection vulnerability in Dovecot 1.0.x before 1.0.13, and 1.1.x before 1.1.rc3, when using blocking passdbs, allows remote attackers to bypass the password check via a password containing TAB characters, which...Show more
Argument injection vulnerability in Dovecot 1.0.x before 1.0.13, and 1.1.x before 1.1.rc3, when using blocking passdbs, allows remote attackers to bypass the password check via a password containing TAB characters, which are treated as argument delimiters that enable the skip_password_check field to be specified.Show less
CVE-2008-1199
1Dovecot
1Dovecot
Apr 23, 2026
Mar 6, 2008
N/A· v4
N/A· v3
4.4 MEDIUM· v2
Dovecot before 1.0.11, when configured to use mail_extra_groups to allow Dovecot to create dotlocks in /var/mail, might allow local users to read sensitive mail files for other users, or modify files or directories that...Show more
Dovecot before 1.0.11, when configured to use mail_extra_groups to allow Dovecot to create dotlocks in /var/mail, might allow local users to read sensitive mail files for other users, or modify files or directories that are writable by group, via a symlink attack.Show less
CVE-2007-6598
1Dovecot
1Dovecot
Apr 23, 2026
Jan 4, 2008
N/A· v4
N/A· v3
6.8 MEDIUM· v2
Dovecot before 1.0.10, with certain configuration options including use of %variables, does not properly maintain the LDAP+auth cache, which might allow remote authenticated users to login as a different user who has the...Show more
Dovecot before 1.0.10, with certain configuration options including use of %variables, does not properly maintain the LDAP+auth cache, which might allow remote authenticated users to login as a different user who has the same password.Show less
CVE-2007-4211
1Dovecot
1Dovecot
Apr 23, 2026
Aug 8, 2007
N/A· v4
N/A· v3
6.0 MEDIUM· v2
The ACL plugin in Dovecot before 1.0.3 allows remote authenticated users with the insert right to save certain flags via a (1) COPY or (2) APPEND command.
CVE-2007-2231
1Dovecot
1Dovecot
Apr 23, 2026
Apr 25, 2007
N/A· v4
N/A· v3
4.3 MEDIUM· v2
Directory traversal vulnerability in index/mbox/mbox-storage.c in Dovecot before 1.0.rc29, when using the zlib plugin, allows remote attackers to read arbitrary gzipped (.gz) mailboxes (mbox files) via a .. (dot dot) seq...Show more
Directory traversal vulnerability in index/mbox/mbox-storage.c in Dovecot before 1.0.rc29, when using the zlib plugin, allows remote attackers to read arbitrary gzipped (.gz) mailboxes (mbox files) via a .. (dot dot) sequence in the mailbox name.Show less