Directory traversal vulnerability in Dovecot 1.0 beta and 1.0 allows remote attackers to list files and directories under the mbox parent directory and obtain mailbox names via “…” sequences in the (1) LIST or (2) DELETE IMAP command.
dovecot.org/list/dovecot-cvs/2006-May/005563.html
secunia.com/advisories/20308
secunia.com/advisories/20315
securityreason.com/securityalert/913
www.debian.org/security/2006/dsa-1080
www.dovecot.org/list/dovecot-news/2006-May/000006.html
www.securityfocus.com/archive/1/433878/100/0/threaded
www.securityfocus.com/bid/17961
www.vupen.com/english/advisories/2006/2013
exchange.xforce.ibmcloud.com/vulnerabilities/26536