CVE-2008-4907

published 2008-11-04

CVE-2008-4907: The message parsing feature in Dovecot 1.1.4 and 1.1.5, when using the FETCH ENVELOPE command in the IMAP client, allows remote attackers to cause a denial of…

Priority P4 19 medium 4.3 CVSS 2.0

AV N AC M Au N C N I N A P

EXPLOIT

The message parsing feature in Dovecot 1.1.4 and 1.1.5, when using the FETCH ENVELOPE command in the IMAP client, allows remote attackers to cause a denial of service (persistent crash) via an email with a malformed From address, which triggers an assertion error, aka "invalid message address parsing bug."

Affected

7 ranges

Vendor	Product	Version range	Fixed in
debian	dovecot	< dovecot 1:1.1.7-1 (bookworm)	dovecot 1:1.1.7-1 (bookworm)
dovecot	dovecot	—	—
dovecot	dovecot	—	—
dovecot	dovecot	>= 0 < 1:1.1.7-1	1:1.1.7-1
dovecot	dovecot	>= 0 < 1:1.1.7-1	1:1.1.7-1
dovecot	dovecot	>= 0 < 1:1.1.7-1	1:1.1.7-1
dovecot	dovecot	>= 0 < 1:1.1.7-1	1:1.1.7-1

CVSS provenance

nvd v2.0 4.3 MEDIUM AV:N/AC:M/Au:N/C:N/I:N/A:P

osv 4.3 MEDIUM

vendor_debian 4.3 LOW

vendor_redhat 4.3 MEDIUM

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-20