Fedora 31: dovecot FEDORA-2019-ea638fb605

September 14, 2019

* CVE-2019-11500: IMAP protocol parser does not properly handle NUL byte when scanning data in quoted strings, leading to out of bounds heap memory writes

Summary

Dovecot is an IMAP server for Linux/UNIX-like systems, written with security

primarily in mind. It also contains a small POP3 server. It supports mail

in either of maildir or mbox formats.

The SQL drivers and authentication plug-ins are in their subpackages.

* CVE-2019-11500: IMAP protocol parser does not properly handle NUL byte when

scanning data in quoted strings, leading to out of bounds heap memory writes

[ 1 ] Bug #1742010 - dovecot-2.3.7.1 is available

https://bugzilla.redhat.com/show_bug.cgi?id=1742010

[ 2 ] Bug #1746666 - CVE-2019-11500 dovecot: improper NULL byte handling in IMAP and ManageSieve protocol parsers leads to out of bounds writes [fedora-all]

https://bugzilla.redhat.com/show_bug.cgi?id=1746666

su -c 'dnf upgrade --advisory FEDORA-2019-ea638fb605' at the command

line. For more information, refer to the dnf documentation available at

https://dnf.readthedocs.io/en/latest/command_ref.html

All packages are signed with the Fedora Project GPG key. More details on the

GPG keys used by the Fedora Project can be found at

package-announce mailing list -- package-announce@lists.fedoraproject.org

To unsubscribe send an email to package-announce-leave@lists.fedoraproject.org

Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/

List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines

List Archives: https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/

FEDORA-2019-ea638fb605 2019-09-14 16:29:06.037941 Product : Fedora 31 Version : 2.3.7.2 Release : 1.fc31 URL : https://www.dovecot.org/ Summary : Secure imap and pop3 server Description : Dovecot is an IMAP server for Linux/UNIX-like systems, written with security primarily in mind. It also contains a small POP3 server. It supports mail in either of maildir or mbox formats. The SQL drivers and authentication plug-ins are in their subpackages. * CVE-2019-11500: IMAP protocol parser does not properly handle NUL byte when scanning data in quoted strings, leading to out of bounds heap memory writes [ 1 ] Bug #1742010 - dovecot-2.3.7.1 is available https://bugzilla.redhat.com/show_bug.cgi?id=1742010 [ 2 ] Bug #1746666 - CVE-2019-11500 dovecot: improper NULL byte handling in IMAP and ManageSieve protocol parsers leads to out of bounds writes [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1746666 su -c 'dnf upgrade --advisory FEDORA-2019-ea638fb605' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at package-announce mailing list -- package-announce@lists.fedoraproject.org To unsubscribe send an email to package-announce-leave@lists.fedoraproject.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/