CVE-2017-14461: Infoleak
A specially crafted email delivered over SMTP and passed on to Dovecot by MTA can trigger an out of bounds read resulting in potential sensitive information disclosure and denial of service. In order to trigger this vulnerability, an attacker needs to send a specially crafted email message to the server.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2017-14461?
CVE-2017-14461 is a vulnerability that allows a specially crafted email to trigger an out of bounds read in Dovecot, potentially resulting in sensitive information disclosure and denial of service.
What is the severity of CVE-2017-14461?
The severity of CVE-2017-14461 is high, with a severity value of 7.1.
How does CVE-2017-14461 affect Dovecot?
CVE-2017-14461 affects Dovecot versions 2.2.33.2 and earlier, as well as some Ubuntu and Debian Linux distributions.
How can an attacker exploit CVE-2017-14461?
An attacker can exploit CVE-2017-14461 by sending a specially crafted email message to the server running Dovecot.
What is the remedy for CVE-2017-14461?
To remedy CVE-2017-14461, it is recommended to update Dovecot to version 2.2.34 or 2.3.0.1, or apply the appropriate security patches provided by the Ubuntu and Debian distributions.