SB2019121628 - NULL pointer dereference in dovecot (Alpine package)
Published: December 16, 2019
Security Bulletin ID
SB2019121628
Severity
Medium
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Remote access
Highest impact
Denial of service
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) NULL pointer dereference (CVE-ID: CVE-2019-19722)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a NULL pointer dereference error when parsing group emails or empty values in From/To email fields in "src/plugins/push-notification/push-notification-event-message-common.c". A remote attacker can send an email with a group email address or an empty value in From or To fields and crash push notification drivers.
Remediation
Install update from vendor's website.