SUSE-SU-2020:1380-1
- Source
- https://www.suse.com/support/update/announcement/2020/suse-su-20201380-1/
- Import Source
- https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2020:1380-1.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/SUSE-SU-2020:1380-1
- Related
- Published
- 2020-05-22T06:01:05Z
- Modified
- 2020-05-22T06:01:05Z
- Summary
- Security update for dovecot23
- Details
-
This update for dovecot23 to 2.3.10 fixes the following issues:
Security issues fixed:
- CVE-2020-10957: Fixed a crash caused by malformed NOOP commands (bsc#1171457).
- CVE-2020-10958: Fixed a use-after-free when receiving too many newlines (bsc#1171458).
- CVE-2020-10967: Fixed a crash in the lmtp and submission components caused by mails with empty quoted localparts (bsc#1171456).
Non-security issues fixed:
- The update to 2.3.10 fixes several bugs. Please refer to https://dovecot.org/doc/NEWS for a complete list of changes.
- References
-
- https://www.suse.com/support/update/announcement/2020/suse-su-20201380-1/
- https://bugzilla.suse.com/1171456
- https://bugzilla.suse.com/1171457
- https://bugzilla.suse.com/1171458
- https://www.suse.com/security/cve/CVE-2020-10957
- https://www.suse.com/security/cve/CVE-2020-10958
- https://www.suse.com/security/cve/CVE-2020-10967
Affected packages
SUSE:Linux Enterprise Module for Server Applications 15 SP1 / dovecot23
Package
- Name
- dovecot23
- Purl
- pkg:rpm/suse/dovecot23&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Server%20Applications%2015%20SP1
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affectedFixed2.3.10-11.1
Ecosystem specific
{
"binaries": [
{
"dovecot23-fts-lucene": "2.3.10-11.1",
"dovecot23-devel": "2.3.10-11.1",
"dovecot23-backend-pgsql": "2.3.10-11.1",
"dovecot23-fts": "2.3.10-11.1",
"dovecot23": "2.3.10-11.1",
"dovecot23-backend-sqlite": "2.3.10-11.1",
"dovecot23-backend-mysql": "2.3.10-11.1",
"dovecot23-fts-solr": "2.3.10-11.1",
"dovecot23-fts-squat": "2.3.10-11.1"
}
]
}