GCVE - cpe:2.3:a:dovecot:dovecot:2.0.15:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:dovecot:dovecot:2.0.15:*:*:*:*:*:*:*

part: a version: 2.0.15 update: *

Vendor	Dovecot (`4878954c-d284-58ab-9fab-9fdb4dcb62a5`)
Product	Dovecot (`69315d6c-8387-56ce-bab4-fd11daf3f0a0`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:deb/debian/dovecot-core`	purl2cpe	2026-06-01 10:18:22.101456
`pkg:deb/ubuntu/dovecot-core`	purl2cpe	2026-06-01 10:18:22.101458
`pkg:docker/dovecot/dovecot`	purl2cpe	2026-06-01 10:18:22.101460
`pkg:github/dovecot/core`	purl2cpe	2026-06-01 10:18:22.101462
`pkg:rpm/fedora/dovecot`	purl2cpe	2026-06-01 10:18:22.101464
`pkg:rpm/opensuse/dovecot-core`	purl2cpe	2026-06-01 10:18:22.101465

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2014-3430`	vulnerable	2026-06-08 05:05:32.619228	Details available Dovecot 1.1 before 2.2.13 and dovecot-ee before 2.1.7.7 and 2.2.x before 2.2.12.12 does not properly close old connections, which allows remote attackers to cause a denial of service (resource consumption) via an incomplete SSL/TLS handshake for an IMAP/POP3 connection. Published: 2014-05-14T19:00:00.000Z Updated: 2024-08-06T10:43:06.101Z Open on db.gcve.eu Reference links http://www.openwall.com/lists/oss-security/2014/05/09/4 http://secunia.com/advisories/59051 http://www.openwall.com/lists/oss-security/2014/05/09/8 http://secunia.com/advisories/59537 http://advisories.mageia.org/MGASA-2014-0223.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2013-6171`	vulnerable	2026-06-08 05:04:55.531088	Details available checkpassword-reply in Dovecot before 2.2.7 performs setuid operations to a user who is authenticating, which allows local users to bypass authentication and access virtual email accounts by attaching to the process and using a restricted file descriptor to modify account information in the response to the dovecot-auth server. Published: 2013-12-09T11:00:00.000Z Updated: 2024-08-06T17:29:42.974Z Open on db.gcve.eu Reference links http://cpanel.net/tsr-2013-0010-full-disclosure/ http://wiki2.dovecot.org/AuthDatabase/CheckPassword#Security https://usn.ubuntu.com/3556-2/ http://secunia.com/advisories/54808 http://www.dovecot.org/list/dovecot-news/2013-November/000264.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2011-4318`	vulnerable	2026-06-08 04:59:30.349108	Details available Dovecot 2.0.x before 2.0.16, when ssl or starttls is enabled and hostname is used to define the proxy destination, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a valid certificate for a different hostname. Published: 2013-03-07T01:00:00.000Z Updated: 2024-08-07T00:01:51.650Z Open on db.gcve.eu Reference links http://secunia.com/advisories/46886 http://rhn.redhat.com/errata/RHSA-2013-0520.html https://bugs.gentoo.org/show_bug.cgi?id=390887 https://bugzilla.redhat.com/show_bug.cgi?id=754980 http://secunia.com/advisories/52311	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.