CVE-2020-10958

In Dovecot before 2.3.10.1, a crafted SMTP/LMTP message triggers an unauthenticated use-after-free bug in submission-login, submission, or lmtp, and can lead…

Medium · published May 18, 2020

CVSS v3.0
5.3
EPSS
6%
Percentile
93.4
In the wild
Unconfirmed
What it is

In Dovecot before 2.3.10.1, a crafted SMTP/LMTP message triggers an unauthenticated use-after-free bug in submission-login, submission, or lmtp, and can lead to a crash under circumstances involving many newlines after a command.

The record
Technical detail
CVSS v3.0
5.3 · MEDIUM
Vector
CVSS:3.0/AC:L/AV:N/A:L/C:N/I:N/PR:N/S:U/UI:N
CVSS v4.0
Not supplied
EPSS
0.06122 · 93.4th percentile
Published
2020-05-18T14:00Z
EPSS history
Timeline
  • 18 MAY 14:00Z
    In Dovecot before 2.3.10.1, a crafted SMTP/LMTP message triggers an unauthenticated use-after-free bug in submission-login, submission, or lmtp, and can lead…
    cvelistv5