Skip to content

dovecot requires update #223

Closed
Closed
dovecot requires update#223
Assignees
jperkin

Description

@vtoc
vtoc
opened on Sep 14, 2019

https://www.openwall.com/lists/oss-security/2019/08/28/3

Vulnerable version: All versions prior to 2.3.7.2 and 2.2.36.4

This vulnerability allows for out-of-bounds writes to objects stored on
the heap up to 8096 bytes in pre-login phase, and 65536 bytes post-login
phase, allowing sufficiently skilled attacker to perform complicated
attacks that can lead to leaking private information or remote code
execution. Abuse of this bug is very difficult to observe, as it does
not necessarily cause a crash. Attempts to abuse this bug are not
directly evident from logs.

Activity

  1. jperkin
    self-assigned this
    on Sep 16, 2019

  2. jperkin commented on Sep 16, 2019

    @jperkin
    jperkin
    on Sep 16, 2019
    Collaborator

    Available in trunk since Sept 9 and 2018Q4 since Sept 11.

  3. jperkin
    closed this as completedon Sep 16, 2019

  4. jperkin commented on Sep 16, 2019

    @jperkin
    jperkin
    on Sep 16, 2019
    Collaborator

    Backported to 2016Q4 too, packages now available (pending mirror catchup).

  5. jperkin
    added a commit that references this issue on Sep 18, 2019

    libcec: Update to 4.0.4

    28bd29a
  6. jperkin
    added a commit that references this issue on Oct 29, 2019

    haxm: Upgrade to 7.5.4

    abadfe1
  7. jperkin
    added 2 commits that reference this issue on Nov 6, 2019

    misc/ruby-sprockets: update to 4.0.0

    e558fba

    Add SoftHSM version 2.5.0.

    69e3be6
  8. jperkin
    added a commit that references this issue on Jan 3, 2020

    Update to text-1.2.4.0

    465cb7b
  9. jperkin
    added a commit that references this issue on Feb 6, 2020

    Update to 3.3.1. From the changelog:

    859cadb
  10. jperkin
    added a commit that references this issue on Mar 12, 2020

    vala: update to 0.48.0.

    7abb44a
  11. jperkin
    added a commit that references this issue on Mar 26, 2020

    py-gandi.cli: update to 1.5

    97971c3
  12. jperkin
    added a commit that references this issue on Jun 7, 2020

    textproc/ruby-coderay: update to 1.1.3

    f32f9ff
  13. jperkin
    added 2 commits that reference this issue on Sep 9, 2020

    go-ffuf: Update to 1.1.0

    0f8c72f

    audio/ncspot: update to 0.2.2

    dfa94df

  14. 92 remaining items

  15. jperkin
    added 8 commits that reference this issue on May 14, 2026

    multimedia/t-rec: update to 0.7.7

    977608d

    security/rbw: update to 1.13.2

    23d89fe

    getmail6: update to 6.19.08.

    5ffb3ac

    py-aiodns: update to 4.0.0.

    eb1b852

    archivers/par2: update to 1.1.0

    c272865

    games/chess-tui: update to 2.5.1

    0c5960e

    p5-XML-Parser: update to 2.56.

    276bfca

    libsixel: update to 1.8.7r1.

    12d98f9
  16. github-actions
    added a commit that references this issue on May 19, 2026

    geography/spatialindex: Update to 2.0.0

    8c56e8f
  17. jperkin
    added 4 commits that reference this issue on May 22, 2026

    games/chess-tui: update to 2.5.1

    b8e4375

    p5-XML-Parser: update to 2.56.

    3ec80f6

    libsixel: update to 1.8.7r1.

    e2fd2e6

    geography/spatialindex: Update to 2.0.0

    824fc04
  18. github-actions
    added a commit that references this issue on Jun 27, 2026

    devel/feluda: update to 1.14.0

    de487bb
  19. github-actions
    added a commit that references this issue on Sep 6, 2026

    devel/ruby-pycall: update to 1.5.3

    1846be1
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

No labels
No labels

Type

No type

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions