- Vulnerability/
- USN-4456-2
USN-4456-2: Dovecot vulnerabilities
First published: Mon Aug 17 2020(Updated: )
USN-4456-1 fixed several vulnerabilities in Dovecot. This update provides the corresponding update for Ubuntu 14.04 ESM. Original advisory details: It was discovered that Dovecot incorrectly handled deeply nested MIME parts. A remote attacker could possibly use this issue to cause Dovecot to consume resources, resulting in a denial of service. (CVE-2020-12100) It was discovered that Dovecot incorrectly handled memory when using NTLM. A remote attacker could possibly use this issue to cause Dovecot to crash, resulting in a denial of service. (CVE-2020-12673) It was discovered that the Dovecot RPA mechanism incorrectly handled zero-length messages. A remote attacker could possibly use this issue to cause Dovecot to crash, resulting in a denial of service. (CVE-2020-12674)
| Affected Software | Affected Version | How to fix |
|---|---|---|
| All of | ||
| ubuntu/dovecot-core | <1:2.2.9-1ubuntu2.6+esm3 | 1:2.2.9-1ubuntu2.6+esm3 |
| =14.04 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Child vulnerabilities
(Contains the following vulnerabilities)
Frequently Asked Questions
What vulnerabilities are fixed in USN-4456-2?
USN-4456-2 fixes several vulnerabilities in Dovecot. Specifically, it addresses CVE-2020-12100, CVE-2020-12673, and CVE-2020-12674.
How do these vulnerabilities affect Dovecot?
The vulnerabilities addressed by USN-4456-2 could allow a remote attacker to cause Dovecot to crash, disclose sensitive information, or potentially execute arbitrary code.
Which versions of Dovecot are affected by these vulnerabilities?
Versions of Dovecot up to and including 1:2.2.9-1ubuntu2.6+esm3 are affected.
How can I fix these vulnerabilities?
To fix these vulnerabilities, update the dovecot-core package to version 1:2.2.9-1ubuntu2.6+esm3 or later.
Where can I find more information about these vulnerabilities?
You can find more information about the vulnerabilities fixed in USN-4456-2 on the Ubuntu security website. The specific CVEs addressed are CVE-2020-12100, CVE-2020-12673, and CVE-2020-12674.
- agent/description
- agent/event
- agent/first-publish-date
- agent/last-modified-date
- agent/references
- agent/severity
- agent/softwarecombine
- agent/tags
- agent/title
- agent/type
- collector/usn
- source/Ubuntu
- anchor-related/USN-4456-1
- agent/software-canonical-lookup
- package-manager/ubuntu
- vendor/ubuntu
- canonical/ubuntu ubuntu
- version/ubuntu ubuntu/14.04