https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 12:31:58 +0000 https://cve.radiocsirt.org/vuln/bdu:2026-10394 bdu:2026-10394 https://cve.radiocsirt.org/vuln/bdu:2026-10394 https://cve.radiocsirt.org/vuln/euvd-2026-277859 EUVD-2026-277859 https://cve.radiocsirt.org/vuln/euvd-2026-277859 https://cve.radiocsirt.org/vuln/fkie_cve-2025-59031 <p>Dovecot has provided a script to use for attachment to text conversion. This script unsafely handles zip-style attachments. Attacker can use specially crafted OOXML documents to cause unintended files on the system to be indexed and subsequently ending up in FTS indexes. Do not use the provided script, instead, use something else like FTS tika. No publicly available exploits are known.</p> <p>Dovecot has provided a script to use for attachment to text conversion. This script unsafely handles zip-style attachments. Attacker can use specially crafted OOXML documents to cause unintended files on the system to be indexed and subsequently ending up in FTS indexes. Do not use the provided script, instead, use something else like FTS tika. No publicly available exploits are known.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-59031 https://cve.radiocsirt.org/vuln/ghsa-7r6x-855q-h59r <p>Dovecot has provided a script to use for attachment to text conversion. This script unsafely handles zip-style attachments. Attacker can use specially crafted OOXML documents to cause unintended files on the system to be indexed and subsequently ending up in FTS indexes. Do not use the provided script, instead, use something else like FTS tika. No publicly available exploits are known.</p> <p>Dovecot has provided a script to use for attachment to text conversion. This script unsafely handles zip-style attachments. Attacker can use specially crafted OOXML documents to cause unintended files on the system to be indexed and subsequently ending up in FTS indexes. Do not use the provided script, instead, use something else like FTS tika. No publicly available exploits are known.</p> https://cve.radiocsirt.org/vuln/ghsa-7r6x-855q-h59r https://cve.radiocsirt.org/vuln/oesa-2026-1849 <p><strong>Affected:</strong> openEuler:22.03-LTS-SP4: dovecot, openEuler:24.03-LTS: dovecot, openEuler:24.03-LTS-SP1: dovecot, openEuler:24.03-LTS-SP2: dovecot, openEuler:24.03-LTS-SP3: dovecot, openEuler:20.03-LTS-SP4: dovecot</p> <p>Dovecot is an IMAP server for Linux/UNIX-like systemsa wrapper package that will just handle common things for all versioned dovecot packages. Security Fix(es):</p> <p>Dovecot has provided a script to use for attachment to text conversion. This script unsafely handles zip-style attachments. Attacker can use specially crafted OOXML documents to cause unintended files on the system to be indexed and subsequently ending up in FTS indexes. Do not use the provided script, instead, use something else like FTS tika. No publicly available exploits are known.(CVE-2025-59031)</p> <p>ManageSieve AUTHENTICATE command crashes when using literal as SASL initial response. This can be used to crash ManageSieve service repeatedly, making it unavailable for other users. Control access to ManageSieve port, or disable the service if it&amp;apos;s not needed. Alternatively upgrade to a fixed version. No publicly available exploits are known.(CVE-2025-59032)</p> <p>When dovecot has been configured to use per-domain passwd files, and they are placed one path component above /etc, or slash has been added to allowed characters, path traversal can happen if the domain component is directory partial. This allows inadvertently reading /etc/passwd (or some other path which ends with passwd). If this file contains passwords, it can be used to authenticate wrongly, or if this is userdb, it can unexpectly make system users appear valid users. Upgrade to fixed version, or use different authentication scheme that does not rel…</p> <p><strong>Affected:</strong> openEuler:22.03-LTS-SP4: dovecot, openEuler:24.03-LTS: dovecot, openEuler:24.03-LTS-SP1: dovecot, openEuler:24.03-LTS-SP2: dovecot, openEuler:24.03-LTS-SP3: dovecot, openEuler:20.03-LTS-SP4: dovecot</p> <p>Dovecot is an IMAP server for Linux/UNIX-like systemsa wrapper package that will just handle common things for all versioned dovecot packages. Security Fix(es):</p> <p>Dovecot has provided a script to use for attachment to text conversion. This script unsafely handles zip-style attachments. Attacker can use specially crafted OOXML documents to cause unintended files on the system to be indexed and subsequently ending up in FTS indexes. Do not use the provided script, instead, use something else like FTS tika. No publicly available exploits are known.(CVE-2025-59031)</p> <p>ManageSieve AUTHENTICATE command crashes when using literal as SASL initial response. This can be used to crash ManageSieve service repeatedly, making it unavailable for other users. Control access to ManageSieve port, or disable the service if it&amp;apos;s not needed. Alternatively upgrade to a fixed version. No publicly available exploits are known.(CVE-2025-59032)</p> <p>When dovecot has been configured to use per-domain passwd files, and they are placed one path component above /etc, or slash has been added to allowed characters, path traversal can happen if the domain component is directory partial. This allows inadvertently reading /etc/passwd (or some other path which ends with passwd). If this file contains passwords, it can be used to authenticate wrongly, or if this is userdb, it can unexpectly make system users appear valid users. Upgrade to fixed version, or use different authentication scheme that does not rel…</p> https://cve.radiocsirt.org/vuln/oesa-2026-1849 https://cve.radiocsirt.org/vuln/opensuse-su-2026:10442-1 <p>dovecot24-2.4.3-1.1 on GA media</p> <p>dovecot24-2.4.3-1.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2026:10442-1 https://cve.radiocsirt.org/vuln/oxdc-adv-2026-0001 OXDC-ADV-2026-0001 https://cve.radiocsirt.org/vuln/oxdc-adv-2026-0001 https://cve.radiocsirt.org/vuln/suse-su-2026:1641-1 <p>Security update for dovecot22</p> <p>Security update for dovecot22</p> https://cve.radiocsirt.org/vuln/suse-su-2026:1641-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2025-59031 <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: dovecot, Ubuntu:16.04:LTS: dovecot, Ubuntu:18.04:LTS: dovecot, Ubuntu:20.04:LTS: dovecot, Ubuntu:22.04:LTS: dovecot, Ubuntu:24.04:LTS: dovecot, Ubuntu:25.10: dovecot</p> <p>Dovecot has provided a script to use for attachment to text conversion. This script unsafely handles zip-style attachments. Attacker can use specially crafted OOXML documents to cause unintended files on the system to be indexed and subsequently ending up in FTS indexes. Do not use the provided script, instead, use something else like FTS tika. No publicly available exploits are known.</p> <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: dovecot, Ubuntu:16.04:LTS: dovecot, Ubuntu:18.04:LTS: dovecot, Ubuntu:20.04:LTS: dovecot, Ubuntu:22.04:LTS: dovecot, Ubuntu:24.04:LTS: dovecot, Ubuntu:25.10: dovecot</p> <p>Dovecot has provided a script to use for attachment to text conversion. This script unsafely handles zip-style attachments. Attacker can use specially crafted OOXML documents to cause unintended files on the system to be indexed and subsequently ending up in FTS indexes. Do not use the provided script, instead, use something else like FTS tika. No publicly available exploits are known.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2025-59031 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-0891 <p>Ein Angreifer kann mehrere Schwachstellen in Dovecot ausnutzen, um SQL-Injection-Angriffe durchzuführen, die Authentifizierung zu umgehen, vertrauliche Informationen offenzulegen oder einen Denial-of-Service-Zustand herbeizuführen.</p> <p>Ein Angreifer kann mehrere Schwachstellen in Dovecot ausnutzen, um SQL-Injection-Angriffe durchzuführen, die Authentifizierung zu umgehen, vertrauliche Informationen offenzulegen oder einen Denial-of-Service-Zustand herbeizuführen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-0891