CVE-2010-3779

2010-10-0621:00:01

Debian Security Bug Tracker

security-tracker.debian.org

CVSS2

3.5

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

EPSS

0.002

Percentile

60.8%

JSON

Dovecot 1.2.x before 1.2.15 and 2.0.x before 2.0.beta2 grants the admin permission to the owner of each mailbox in a non-public namespace, which might allow remote authenticated users to bypass intended access restrictions by changing the ACL of a mailbox, as demonstrated by a symlinked shared mailbox.

OSVersionArchitecturePackageVersionFilename
Debian12alldovecot< 1:1.2.15-1dovecot_1:1.2.15-1_all.deb
Debian11alldovecot< 1:1.2.15-1dovecot_1:1.2.15-1_all.deb
Debian999alldovecot< 1:1.2.15-1dovecot_1:1.2.15-1_all.deb
Debian13alldovecot< 1:1.2.15-1dovecot_1:1.2.15-1_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	12	all	dovecot	< 1:1.2.15-1	dovecot_1:1.2.15-1_all.deb
Debian	11	all	dovecot	< 1:1.2.15-1	dovecot_1:1.2.15-1_all.deb
Debian	999	all	dovecot	< 1:1.2.15-1	dovecot_1:1.2.15-1_all.deb
Debian	13	all	dovecot	< 1:1.2.15-1	dovecot_1:1.2.15-1_all.deb