CVE-2017-14461

HighCVSS 7.1/10Last modified Jun 17, 2026

Description

A specially crafted email delivered over SMTP and passed on to Dovecot by MTA can trigger an out of bounds read resulting in potential sensitive information disclosure and denial of service. In order to trigger this vulnerability, an attacker needs to send a specially crafted email message to the server.

Metrics

CVSS 3.0 7.1/10CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H

Weakness enumeration

CWE-125CWE-200

Affected software

VendorProductVersions
The Dovecot ProjectDovecot2.2.33.2

References

Timeline

Published
Mar 2, 2018
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2017

CVE-2017-144629.8An exploitable access control vulnerability exists in the data, program, and function file permissions functionality of Allen Bradley MicrolCVE-2017-144639.8An exploitable access control vulnerability exists in the data, program, and function file permissions functionality of Allen Bradley MicrolCVE-2017-144649.8An exploitable access control vulnerability exists in the data, program, and function file permissions functionality of Allen Bradley MicrolCVE-2017-144659.8An exploitable access control vulnerability exists in the data, program, and function file permissions functionality of Allen Bradley MicrolCVE-2017-144669.8An exploitable access control vulnerability exists in the data, program, and function file permissions functionality of Allen Bradley MicrolCVE-2017-144679.8An exploitable access control vulnerability exists in the data, program, and function file permissions functionality of Allen Bradley MicrolCVE-2017-144689.8An exploitable access control vulnerability exists in the data, program, and function file permissions functionality of Allen Bradley MicrolCVE-2017-144699.8An exploitable access control vulnerability exists in the data, program, and function file permissions functionality of Allen Bradley MicrolCVE-2017-14475.4IBM Emptoris Sourcing 9.5 - 10.1.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript codeCVE-2017-144709.8An exploitable access control vulnerability exists in the data, program, and function file permissions functionality of Allen Bradley MicrolCVE-2017-144719.8An exploitable access control vulnerability exists in the data, program, and function file permissions functionality of Allen Bradley MicrolCVE-2017-144729.8An exploitable access control vulnerability exists in the data, program, and function file permissions functionality of Allen Bradley Microl
CVE-2017-14461: High severity, CVSS 7.1 | Vulnix