OX Dovecot CE vulnerabilities
5 known vulnerabilities in OX Dovecot CE from Open-Xchange. 5 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 7.4 High severity
OX Dovecot Pro: Improper Authentication
An attacker that holds a token intended for a different purpose can authenticate, because when an OAuth2 token response does not contain a scope claim, the audience claim is used in its place and checked against the configured required scopes. These are differ
- 7.5 High severity
OX Dovecot Pro: Uncontrolled Resource Consumption
An unauthenticated attacker can send an IMAP ID command with a very large number of parameters before logging in, which causes memory and CPU usage to grow disproportionately. The login process can be terminated by the out-of-memory handling, which also termin
- 9.1 Critical severity
OX Dovecot Pro: Use After Free
An attacker that has valid credentials can use a Sieve script with the editheader extension to trigger a use-after-free in the mail editing code, and to write memory contents beyond the intended buffer into the delivered mail. This causes memory leak and oppor
- 7.5 High severity
OX Dovecot Pro: Uncontrolled Resource Consumption
An unauthenticated attacker can crash the ManageSieve login process by sending a small malformed command before authenticating. If running in high-security mode (default for community releases), only the attacker's own connection is terminated. If running in h
- 7.5 High severity
OX Dovecot Pro: Uncontrolled Resource Consumption
An attacker that can send mail to a user can craft a message whose headers contain a very large number of email addresses or MIME parameters, which causes excessive memory usage when the message is later parsed. The message is still delivered, but reading it o