CVE-2017-14461 Information disclosure in Dovecot
A specially crafted email can trigger an out-of-bounds read in Dovecot, leading to sensitive information disclosure and denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2017-14461?
CVE-2017-14461 is a medium-severity vulnerability in Debian Debian Linux, published on 2 Mar 2018. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
A specially crafted email delivered over SMTP and passed on to Dovecot by MTA can trigger an out of bounds read resulting in potential sensitive information disclosure and denial of service. In order to trigger this vulnerability, an attacker needs to send a specially crafted email message to the server.
Which versions are affected by CVE-2017-14461?
It affects 3 products.
Linux distribution packages (3)
dovecot22 SUSE:Linux Enterprise Server 12 SP3 | All versions | 2.2.31-19.8.1 |
dovecot22 SUSE:Linux Enterprise Server for SAP Applications 12 SP3 | All versions | 2.2.31-19.8.1 |
dovecot22 SUSE:Linux Enterprise Software Development Kit 12 SP3 | All versions | 2.2.31-19.8.1 |
Products include Debian Debian Linux, Dovecot Dovecot, Ubuntu Ubuntu.
How do I fix CVE-2017-14461?
Apply the vendor's patch.
Is CVE-2017-14461 being exploited?
There is no known exploitation of CVE-2017-14461 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as ALPINE-CVE-2017-14461, CLSA-2026-1781102465, DEBIAN-CVE-2017-14461, GHSA-r34f-p748-2x25, SUSE-SU-2018:1125-1, UBUNTU-CVE-2017-14461.