VDB
ALPINE-CVE-2019-11500
ALPINE-CVE-2019-11500
PUBLISHED
CVSS 9.800000190734863 CRITICAL
In Dovecot before 2.2.36.4 and 2.3.x before 2.3.7.2 (and Pigeonhole before 0.5.7.2), protocol processing can fail for quoted strings. This occurs because '\0' characters are mishandled, and can lead to out-of-bounds writes and remote code execution.
Risk Scores
CVSS 3.0
9.800000190734863
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Alpine:v3.11 | dovecot | 2.2.15-r2, 2.2.16-r1, 2.2.18-r1 |
| Alpine:v3.21 | dovecot | 2.2.13-r0, 0, 1.1.11-r0 |
| Alpine:v3.9 | dovecot | 2.2.27-r1, 2.2.1-r0, 2.2.10-r0 |
| Alpine:v3.20 | dovecot | 2.2.27-r0, 2.3.0, 2.3.0 |
| Alpine:v3.13 | dovecot | 0, 2.3.0, 2.3.0 |
| Alpine:v3.16 | dovecot | 1.2.11-r4, 2.3.0, 2.3.0 |
| Alpine:v3.23 | dovecot | 2.2.12-r0, 2.1.2-r0, 2.2.10-r0 |
| Alpine:v3.10 | dovecot | 2.2.29.1-r0, 0, 1.1.11-r0 |
| Alpine:v3.12 | dovecot | 2.2.33.2-r0, 2.3.7.1-r0, 2.3.6-r1 |
| Alpine:v3.15 | dovecot | 2.2.27-r1, 2.3.0, 2.3.0 |
| Alpine:v3.14 | dovecot | 2.1.15-r0, 0, 1.1.11-r0 |
| Alpine:v3.8 | dovecot | 1.1.11-r0, 1.1.13-r0, 0 |
| Alpine:v3.19 | dovecot | 1.1.11-r1, 1.1.11-r0, 0 |
| Alpine:v3.7 | dovecot | 2.2.2-r0, 2.2.2-r1, 2.2.20-r0 |
| Alpine:v3.17 | dovecot | 2.2.20-r0, 2.2.27-r2, 2.3.1-r1 |
| Alpine:v3.24 | dovecot | 0, 2.3.0, 2.3.0 |
| Alpine:v3.22 | dovecot | 2.2.19-r1, 2.3.0, 2.3.0 |
| Alpine:v3.18 | dovecot | 2.3.6-r0, 2.3.0, 2.3.0 |
Timeline
- Aug 29, 2019 CVE Published
- Jul 8, 2026 CVE Updated
- Aug 8, 2026 Distribution Patch