Vulnerability Database

289,784

Total vulnerabilities in the database

CVE-2019-11500

In Dovecot before 2.2.36.4 and 2.3.x before 2.3.7.2 (and Pigeonhole before 0.5.7.2), protocol processing can fail for quoted strings. This occurs because '\0' characters are mishandled, and can lead to out-of-bounds writes and remote code execution.

  • Published: Aug 29, 2019
  • Updated: Apr 13, 2023
  • CVE: CVE-2019-11500
  • Severity: Critical
  • Exploit:

CVSS v3:

  • Severity: Critical
  • Score: 9.8
  • AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v2:

  • Severity: High
  • Score: 7.5
  • AV:N/AC:L/Au:N/C:P/I:P/A:P

CWEs:

Software From Fixed in
dovecot / dovecot - 2.2.36.4
dovecot / dovecot 2.3.0 2.3.7.2
dovecot / pigeonhole - 0.5.7.2
debian / debian_linux 8.0 8.0.x
fedoraproject / fedora 30 30.x