Vulnerability Description
A specially crafted email delivered over SMTP and passed on to Dovecot by MTA can trigger an out of bounds read resulting in potential sensitive information disclosure and denial of service. In order to trigger this vulnerability, an attacker needs to send a specially crafted email message to the server.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Dovecot | Dovecot | 2.2.33.2 |
| Debian | Debian Linux | 8.0 |
| Ubuntu | Ubuntu | 14.04 |
Related Weaknesses (CWE)
References
- http://www.securityfocus.com/bid/103201Third Party AdvisoryVDB Entry
- https://lists.debian.org/debian-lts-announce/2018/03/msg00036.html
- https://talosintelligence.com/vulnerability_reports/TALOS-2017-0510Third Party Advisory
- https://usn.ubuntu.com/3587-1/PatchThird Party Advisory
- https://usn.ubuntu.com/3587-2/
- https://www.debian.org/security/2018/dsa-4130Third Party Advisory
- https://www.dovecot.org/list/dovecot-news/2018-February/000370.htmlIssue TrackingVendor Advisory
- http://www.securityfocus.com/bid/103201Third Party AdvisoryVDB Entry
- https://lists.debian.org/debian-lts-announce/2018/03/msg00036.html
- https://talosintelligence.com/vulnerability_reports/TALOS-2017-0510Third Party Advisory
- https://usn.ubuntu.com/3587-1/PatchThird Party Advisory
- https://usn.ubuntu.com/3587-2/
- https://www.debian.org/security/2018/dsa-4130Third Party Advisory
- https://www.dovecot.org/list/dovecot-news/2018-February/000370.htmlIssue TrackingVendor Advisory
FAQ
What is CVE-2017-14461?
CVE-2017-14461 is a vulnerability with a CVSS score of 5.9 (MEDIUM). A specially crafted email delivered over SMTP and passed on to Dovecot by MTA can trigger an out of bounds read resulting in potential sensitive information disclosure and denial of service. In order ...
How severe is CVE-2017-14461?
CVE-2017-14461 has been rated MEDIUM with a CVSS base score of 5.9/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2017-14461?
Check the references section above for vendor advisories and patch information. Affected products include: Dovecot Dovecot, Debian Debian Linux, Ubuntu Ubuntu.