CVE-2017-15132

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

A flaw was found in dovecot 2.0 up to 2.2.33 and 2.3.0. An abort of SASL authentication results in a memory leak in dovecot's auth client used by login processes. The leak has impact in high performance configuration where same login processes are reused and can cause the process to crash due to memory exhaustion.

Metrics

CVSS 3.0 7.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-400CWE-772

Affected software

No affected versions have been published.

Timeline

Published
Jan 25, 2018
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2017

CVE-2017-151337.5A denial of service flaw was found in miekg-dns before 1.0.4. A remote attacker could use carefully timed TCP packets to block the DNS serveCVE-2017-151347.5A stack buffer overflow flaw was found in the way 389-ds-base 1.3.6.x before 1.3.6.13, 1.3.7.x before 1.3.7.9, 1.4.x before 1.4.0.5 handled CVE-2017-151358.1It was found that 389-ds-base since 1.3.6.1 up to and including 1.4.0.3 did not always handle internal hash comparison operations correctly CVE-2017-151362.7When registering and activating a new system with Red Hat Satellite 6 if the new systems hostname is then reset to the hostname of a previouCVE-2017-151375.3The OpenShift image import whitelist failed to enforce restrictions correctly when running commands such as "oc tag", for example. This coulCVE-2017-151385.0The OpenShift Enterprise cluster-read can access webhook tokens which would allow an attacker with sufficient privileges to view confidentiaCVE-2017-151397.5A vulnerability was found in openstack-cinder releases up to and including Queens, allowing newly created volumes in certain storage volume CVE-2017-15154.3IBM Doors Web Access 9.5 and 9.6 could allow an authenticated user to obtain sensitive information from HTTP internal server error responsesCVE-2017-15165.4IBM Doors Web Access 9.5 and 9.6 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit CVE-2017-151855.0plugins/ogg.c in Libmp3splt 0.9.2 calls the libvorbis vorbis_block_clear function with uninitialized data upon detection of invalid input, wCVE-2017-151866.5Double free vulnerability in FFmpeg 3.3.4 and earlier allows remote attackers to cause a denial of service via a crafted AVI file.CVE-2017-151884.8A persistent (stored) XSS vulnerability in the EyesOfNetwork web interface (aka eonweb) 5.1-0 allows remote authenticated administrators to