This update for dovecot23 fixes the following issues :

Security issues fixed :

CVE-2020-10957: Fixed a crash caused by malformed NOOP commands (bsc#1171457).

CVE-2020-10958: Fixed a use-after-free when receiving too many newlines (bsc#1171458).

CVE-2020-10967: Fixed a crash in the lmtp and submission components caused by mails with empty quoted localparts (bsc#1171456).

Non-security issues fixed :

The update to 2.3.10 fixes several bugs. Please refer to https://dovecot.org/doc/NEWS for a complete list of changes.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for dovecot23 to 2.3.10 fixes the following issues :

Security issues fixed :

CVE-2020-10957: Fixed a crash caused by malformed NOOP commands (bsc#1171457).

CVE-2020-10958: Fixed a use-after-free when receiving too many newlines (bsc#1171458).

CVE-2020-10967: Fixed a crash in the lmtp and submission components caused by mails with empty quoted localparts (bsc#1171456).

Non-security issues fixed :

The update to 2.3.10 fixes several bugs. Please refer to https://dovecot.org/doc/NEWS for a complete list of changes.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-4763 advisory.

    - fix CVE-2020-12100 resource exhaustion via deeply nested MIME parts (#1866756)
    - fix CVE-2020-12673 out of bound reads in dovecot NTLM implementation (#1866761)
    - fix CVE-2020-12674 crash due to assert in RPA implementation (#1866768)
    - fix CVE-2020-10957 dovecot: malformed NOOP commands leads to DoS (#1840354)
    - fix CVE-2020-10958 dovecot: command followed by sufficient number of newlines       leads to use-after-free (#1840357)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Several vulnerabilities were discovered in the Dovecot email server, which could cause crashes in the submission, submission-login or lmtp services, resulting in denial of service.

The Rocky Linux 8.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-2026_0035 advisory.

    This advisory aggregates security fixes for the dovecot SRPM in CIQ LTS 8.6. It addresses 21 CVEs:
    CVE-2019-11500, CVE-2020-24386, CVE-2020-25275, CVE-2020-12100, CVE-2017-14461, and 16 more.

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
137535	SUSE SLES15 Security Update : dovecot23 (SUSE-SU-2020:1379-1)	Nessus	SuSE Local Security Checks	6/17/2020	5/13/2022	high
137536	SUSE SLES15 Security Update : dovecot23 (SUSE-SU-2020:1380-1)	Nessus	SuSE Local Security Checks	6/17/2020	5/13/2022	high
142787	Oracle Linux 8 : dovecot (ELSA-2020-4763)	Nessus	Oracle Linux Local Security Checks	11/12/2020	11/1/2024	medium
136754	Debian DSA-4690-1 : dovecot - security update	Nessus	Debian Local Security Checks	5/21/2020	3/12/2024	high
357898	Rocky Linux 8.6 [CIQ] Security Update: dovecot / dovecot-debuginfo / dovecot-debugsource / dovecot-devel / etc Multiple Vulnerabilities (ciqsa-2026_0035)	Nessus	Rocky Linux Local Security Checks	10/1/2026	10/11/2026	critical

Detections

Analytics

Plugins Search

high

high

medium

high

critical