CVE-2008-4907: Input Validation
The message parsing feature in Dovecot 1.1.4 and 1.1.5, when using the FETCH ENVELOPE command in the IMAP client, allows remote attackers to cause a denial of service (persistent crash) via an email with a malformed From address, which triggers an assertion error, aka "invalid message address parsing bug."
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2008-4907?
CVE-2008-4907 is classified as a moderate severity vulnerability due to its potential to cause a denial of service.
How do I fix CVE-2008-4907?
To fix CVE-2008-4907, upgrade Dovecot to version 1.1.6 or later where the issue has been resolved.
What versions of Dovecot are affected by CVE-2008-4907?
CVE-2008-4907 affects Dovecot versions 1.1.4 and 1.1.5.
What type of vulnerability is CVE-2008-4907?
CVE-2008-4907 is a denial of service vulnerability caused by improper message address parsing.
Can CVE-2008-4907 be exploited remotely?
Yes, CVE-2008-4907 can be exploited remotely through the IMAP client using a specially crafted email.