9.8

CVE-2019-11500

Exploit

In Dovecot before 2.2.36.4 and 2.3.x before 2.3.7.2 (and Pigeonhole before 0.5.7.2), protocol processing can fail for quoted strings. This occurs because '\0' characters are mishandled, and can lead to out-of-bounds writes and remote code execution.

Data is provided by the National Vulnerability Database (NVD)
Dovecot ≫ Dovecot Version < 2.2.36.4
Dovecot ≫ Dovecot Version >= 2.3.0 < 2.3.7.2
Dovecot ≫ Pigeonhole Version < 0.5.7.2
Debian ≫ Debian Linux Version8.0
Fedoraproject ≫ Fedora Version30
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 41.27% 0.973
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 9.8 3.9 5.9
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvd@nist.gov 7.5 10 6.4
AV:N/AC:L/Au:N/C:P/I:P/A:P
CWE-787 Out-of-bounds Write

The product writes data past the end, or before the beginning, of the intended buffer.

http://www.openwall.com/lists/oss-security/2019/08/28/3
Third Party Advisory
Exploit
Mailing List