FreshPorts - VuXML

This page displays vulnerability information about FreeBSD Ports.

The last vuln.xml file processed by FreshPorts is:

Revision:  519779
Date:      2019-12-10
Time:      21:06:04Z
Committer: mfechner

List all Vulnerabilities, by package

List all Vulnerabilities, by date

These are the vulnerabilities relating to the commit you have selected:

VuXML IDDescription
abaaecda-ea16-43e2-bad0-d34a9ac576b1Dovecot -- improper input validation

Aki Tuomi reports:

Vulnerability Details: IMAP and ManageSieve protocol parsers do not properly handle NUL byte when scanning data in quoted strings, leading to out of bounds heap memory writes. Risk: This vulnerability allows for out-of-bounds writes to objects stored on the heap up to 8096 bytes in pre-login phase, and 65536 bytes post-login phase, allowing sufficiently skilled attacker to perform complicated attacks that can lead to leaking private information or remote code execution. Abuse of this bug is very difficult to observe, as it does not necessarily cause a crash. Attempts to abuse this bug are not directly evident from logs.


Discovery 2019-04-13
Entry 2019-08-28
dovecot
lt 2.3.7.2

dovecot-pigeonhole
lt 0.5.7.2

https://dovecot.org/pipermail/dovecot/2019-August/116874.html
CVE-2019-11500
a64aa22f-61ec-11e9-85b9-a4badb296695dovecot -- json encoder crash

Aki Tuomi reports:

* CVE-2019-10691: Trying to login with 8bit username containing invalid UTF8 input causes auth process to crash if auth policy is enabled. This could be used rather easily to cause a DoS. Similar crash also happens during mail delivery when using invalid UTF8 in From or Subject header when OX push notification driver is used.


Discovery 2019-04-09
Entry 2019-04-18
Modified 2019-05-26
dovecot
ge 2.3.0 lt 2.3.5.2

dovecot2
ge 2.3.0 lt 2.3.5.2

https://dovecot.org/pipermail/dovecot-news/2019-April/000407.html
CVE-2019-10691
3f98ccb3-6b8a-11e9-9b5c-a4badb296695Dovecot -- Multiple vulnerabilities

Aki Tuomi reports:

Submission-login crashes with signal 11 due to null pointer access when authentication is aborted by disconnecting. This can lead to denial-of-service attack by persistent attacker(s).

Aki Tuomi reports:

Submission-login crashes when authentication is started over TLS secured channel and invalid authentication message is sent. This can lead to denial-of-service attack by persistent attacker(s).


Discovery 2019-03-11
Entry 2019-04-30
dovecot
ge 2.3.0 lt 2.3.6

https://dovecot.org/list/dovecot-news/2019-April/000409.html
CVE-2019-11494
https://dovecot.org/list/dovecot-news/2019-April/000410.html
CVE-2019-11499