Displaying 20 results from an estimated 31 matches for "7524".
Did you mean:
524
2019 Mar 28
1
CVE-2019-7524 backport patch for 2.2.33.2
...hese two files are affected:
dovecot-2.2.36.3/src/lib-storage/index/index-pop3-uidl.c
dovecot-2.2.36.3/src/plugins/fts/fts-api.c
Please correct me if I have missed something.
Best regards
Gerald
-------------- next part --------------
A non-text attachment was scrubbed...
Name: dovecot-CVE-2019-7524-2.2.36-1-3.patch
Type: application/octet-stream
Size: 1217 bytes
Desc: not available
URL: <https://dovecot.org/pipermail/dovecot/attachments/20190328/e012c578/attachment.obj>
2019 Mar 28
2
CVE-2019-7524: Buffer overflow when reading extension header from dovecot index files
....5
Vulnerable component: fts, pop3-uidl-plugin
Report confidence: Confirmed
Researcher credits: Found in internal testing
Solution status: Fixed by Vendor
Fixed version: 2.3.5.1, 2.2.36.3
Vendor notification: 2019-02-05
Solution date: 2019-03-21
Public disclosure: 2019-03-28
CVE reference: CVE-2019-7524
CVSS: 3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C (8.8)
?
Vulnerability Details:
When reading FTS or POP3-UIDL header from dovecot index, the input
buffer size is not bound, and data is copied to target structure causing
stack overflow.
Risk:
This can be used for local root privilege esc...
2019 Mar 28
2
CVE-2019-7524: Buffer overflow when reading extension header from dovecot index files
....5
Vulnerable component: fts, pop3-uidl-plugin
Report confidence: Confirmed
Researcher credits: Found in internal testing
Solution status: Fixed by Vendor
Fixed version: 2.3.5.1, 2.2.36.3
Vendor notification: 2019-02-05
Solution date: 2019-03-21
Public disclosure: 2019-03-28
CVE reference: CVE-2019-7524
CVSS: 3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C (8.8)
?
Vulnerability Details:
When reading FTS or POP3-UIDL header from dovecot index, the input
buffer size is not bound, and data is copied to target structure causing
stack overflow.
Risk:
This can be used for local root privilege esc...
2019 Mar 28
0
Mitigation / disable FTS and pop3-uidl plugin was Re: CVE-2019-7524: Buffer overflow when reading extension header from dovecot index files
On 3/28/2019 7:42 AM, Aki Tuomi via dovecot wrote:
> olution:
> Operators should update to the latest Patch Release. The only workaround
> is to disable FTS and pop3-uidl plugin.
Hi Aki, thanks for the CVE.? For quick mitigation, can you confirm how
to disable these plugins and what they provide?? We'd like to assess if
we are using them while we rollout the fix.
Regards,
KAM
2019 Mar 28
0
Mitigation / disable FTS and pop3-uidl plugin was Re: CVE-2019-7524: Buffer overflow when reading extension header from dovecot index files
On 3/28/2019 10:40 AM, Aki Tuomi wrote:
>
> check for fts in mail_plugins. pop3-uidl is used by pop3_migration
> plugin.
Sorry if I'm dense but can you be more specific?? Are you talking about
checking conf files or binary files??
For example, does the existence of
/usr/local/lib/dovecot/lib20_fts_plugin.so imply an exploitable situation??
Are their settings in a conf file that
2019 Mar 28
2
Mitigation / disable FTS and pop3-uidl plugin was Re: CVE-2019-7524: Buffer overflow when reading extension header from dovecot index files
<!doctype html>
<html>
<head>
<meta charset="UTF-8">
</head>
<body>
<div>
<br>
</div>
<blockquote type="cite">
<div>
On 28 March 2019 16:37 Kevin A. McGrail via dovecot <
<a href="mailto:dovecot@dovecot.org">dovecot@dovecot.org</a>> wrote:
</div>
2019 Mar 28
2
v2.3.5.1 released
https://dovecot.org/releases/2.3/dovecot-2.3.5.1.tar.gz
https://dovecot.org/releases/2.3/dovecot-2.3.5.1.tar.gz.sig
Binary packages in https://repo.dovecot.org/
??? * CVE-2019-7524: Missing input buffer size validation leads into
????? arbitrary buffer overflow when reading fts or pop3 uidl header
????? from Dovecot index. Exploiting this requires direct write access to
????? the index files.
---
Aki Tuomi
Open-Xchange oy
-------------- next part --------------
A non-text a...
2019 Mar 28
2
v2.3.5.1 released
https://dovecot.org/releases/2.3/dovecot-2.3.5.1.tar.gz
https://dovecot.org/releases/2.3/dovecot-2.3.5.1.tar.gz.sig
Binary packages in https://repo.dovecot.org/
??? * CVE-2019-7524: Missing input buffer size validation leads into
????? arbitrary buffer overflow when reading fts or pop3 uidl header
????? from Dovecot index. Exploiting this requires direct write access to
????? the index files.
---
Aki Tuomi
Open-Xchange oy
-------------- next part --------------
A non-text a...
2019 Mar 28
1
v2.2.36.3 released
https://dovecot.org/releases/2.3/dovecot-2.2.36.3.tar.gz
https://dovecot.org/releases/2.3/dovecot-2.2.36.3.tar.gz.sig
??? * CVE-2019-7524: Missing input buffer size validation leads into
????? arbitrary buffer overflow when reading fts or pop3 uidl header
????? from Dovecot index. Exploiting this requires direct write access to
????? the index files.
---
Aki Tuomi
Open-Xchange oy
2019 Mar 28
1
v2.2.36.3 released
https://dovecot.org/releases/2.3/dovecot-2.2.36.3.tar.gz
https://dovecot.org/releases/2.3/dovecot-2.2.36.3.tar.gz.sig
??? * CVE-2019-7524: Missing input buffer size validation leads into
????? arbitrary buffer overflow when reading fts or pop3 uidl header
????? from Dovecot index. Exploiting this requires direct write access to
????? the index files.
---
Aki Tuomi
Open-Xchange oy
2006 Jun 05
4
Swap memory: I can't reconcile this stuff.
...1m gnome-settings-
3385 22304 10m 7576 1.4 11m mixer_applet2
3244 21508 9960 6868 1.3 11m gnome-session
4144 22476 10m 7456 1.4 11m wnck-applet
2587 12412 2364 1940 0.3 9.8m gdm-binary
2846 13220 3340 2728 0.4 9880 gdm-binary
3365 13812 4532 3920 0.6 9280 pam-panel-icon
3355 14768 7524 5984 1.0 7244 metacity
7182 10328 3436 2280 0.4 6892 sendmail
18501 11080 4248 1912 0.5 6832 cupsd
Note that the summary line says 160k of swap is used. The man pages say
the summary and the details under "SWAP" are both reported in "k". No
mention of "m" is made,...
2019 Apr 18
0
v2.3.5.2 released
https://dovecot.org/releases/2.3/dovecot-2.3.5.2.tar.gz
https://dovecot.org/releases/2.3/dovecot-2.3.5.2.tar.gz.sig
Binary packages in https://repo.dovecot.org/
* CVE-2019-7524: Missing input buffer size validation leads into
arbitrary buffer overflow when reading fts or pop3 uidl header
from Dovecot index. Exploiting this requires direct write access to
the index files.
---
Aki Tuomi
Open-Xchange oy
-------------- next part --------------
A non-text attach...
2019 Mar 28
0
v2.3.5.1 released
...> On 28 Mar 2019, at 08:41, Aki Tuomi via dovecot <dovecot at dovecot.org> wrote:
>
> https://dovecot.org/releases/2.3/dovecot-2.3.5.1.tar.gz
> https://dovecot.org/releases/2.3/dovecot-2.3.5.1.tar.gz.sig
> Binary packages in https://repo.dovecot.org/
>
> * CVE-2019-7524: Missing input buffer size validation leads into
> arbitrary buffer overflow when reading fts or pop3 uidl header
> from Dovecot index. Exploiting this requires direct write access to
> the index files.
>
> ---
> Aki Tuomi
> Open-Xchange oy
>
2019 Apr 18
0
v2.3.5.2 released
https://dovecot.org/releases/2.3/dovecot-2.3.5.2.tar.gz
https://dovecot.org/releases/2.3/dovecot-2.3.5.2.tar.gz.sig
Binary packages in https://repo.dovecot.org/
* CVE-2019-7524: Missing input buffer size validation leads into
arbitrary buffer overflow when reading fts or pop3 uidl header
from Dovecot index. Exploiting this requires direct write access to
the index files.
---
Aki Tuomi
Open-Xchange oy
-------------- next part --------------
A non-text attach...
2024 May 28
2
Segfault when parsing UTF-8 text with srcrefs
Hi all,
When I run the following code, R segfaults:
text <- "?"
srcfile <- srcfilecopy("test.r", text)
parse(textConnection(text), srcfile = srcfile)
It doesn't segfault if text is ASCII, or it's not wrapped in
textConnection, or srcfile isn't set.
Hadley
--
http://hadley.nz
[[alternative HTML version deleted]]
2005 Jan 23
2
can iaxcomm run on the same server as Asterisk?
...ize IAX
Client .
bash-2.05b$
and if I start iaxcomm first then launch asterisk, I
get this startup error with asterisk:
bash-2.05b# asterisk -vvvcg
.
. <not shown>
. == Registered channel type 'IAX2' (Inter Asterisk
eXchange Driver (Ver 2))
Jan 23 02:52:11 ERROR[22009]: chan_iax2.c:7524
load_module: Unable to bind to 0.0.0.0 port 4569:
Address already in use
Jan 23 02:52:11 WARNING[22009]: loader.c:345
ast_load_resource: chan_iax2.so: load_module failed,
returning -1
== Manager unregistered action IAXpeers
== Unregistered channel type 'IAX2'
Jan 23 02:52:11 WARNING[220...
2018 Jul 14
3
AWS c5d.9/18xlarge instances not supported
Hi,
why are larger AWS instances c5d.9xlarge and c5d.18xlarge (NVMe SSD attached) NOT supported by Centos7 AMI,
while smaller instances (e.g. c5d.4xlarge) are supported?
Also regular c5.9/18xlarge are supported.
Thanks, Jens-Uwe
Jens-Uwe Schl??ler
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
1998 May 19
1
SAMBA digest 1690
SUBJECT: SAMBA digest 1690
ERROR: Text size exceeds maximum
2011 Feb 18
1
need help with public namespaces
...ecot.index.log
? ??? dovecot.shared
? ??? maildirfolder
? ??? new
? ??? tmp
??? .abuse
? ??? cur
? ? ??? 1298024954.M370551P13355.macchianera,S=16426,W=16772:2,S
? ? ??? 1298024955.M521166P13353.macchianera,S=7563,W=7675:2,
? ? ??? 1298024956.M364817P13353.macchianera,S=7408,W=7524:2,S
? ??? dovecot-uidlist
? ??? dovecot.index
? ??? dovecot.index.cache
? ??? dovecot.index.log
? ??? dovecot.shared
? ??? maildirfolder
? ??? new
? ??? tmp
[some more folders snipped]
??? .root.prefixlists
? ??? cur
? ? ??? 1297754520.M277941P8395.macchianera,W=5249,S=5145:2...
2015 Jan 24
4
Indexing Mail faster
Hi,
I am trying to get faster search results on our webmail client(Roundcube).
Besides using Lucene for FTS are there other options?
Would having all mails indexed give fast results?
Currently the time it takes to search 25,000mails is 4mins. If indexed how
much faster are we looking at?
Really appreciate if someone could advise about this.
Thanks
Kevin