Skip to content
Fencer Vulns
medium 5.9

CVE-2017-14461 json

A specially crafted email delivered over SMTP and passed on to Dovecot by MTA can trigger an out of bounds read resulting in potential sens…

published 2018-03-02 8 y ago modified 2026-06-17 4 mo ago also EUVD-2017-5964

cvss
5.9
version 3.0, CNA
cisa kev
Not listed
not in CISA's catalog
epss
16.7%
EPSS 16.7% chance of exploitation in 30 days, percentile 97%
public exploits
0
none known

Summary

A specially crafted email delivered over SMTP and passed on to Dovecot by MTA can trigger an out of bounds read resulting in potential sensitive information disclosure and denial of service. In order to trigger this vulnerability, an attacker needs to send a specially crafted email message to the server.

Patch / fix

  • dovecot Debian 14, Debian 13, Debian 12 1:2.2.34-1

debian advisories DEBIAN-CVE-2017-14461

  • dovecot Ubuntu 14.04 LTS 1:2.2.9-1ubuntu2.4
  • dovecot Ubuntu 16.04 LTS 1:2.2.22-1ubuntu2.7

ubuntu advisories UBUNTU-CVE-2017-14461

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • dovecot22 SLES for SAP 12 SP3, SLES 12 SP3, SLE Software Development Kit 12 SP3 2.2.31-19.8.1

suse advisories SUSE-SU-2018:1125-1

  • dovecot24 openSUSE Tumbleweed 2.4.0-1.1
  • dovecot23 openSUSE Tumbleweed 2.3.16-1.6

opensuse advisories openSUSE-SU-2025:14715-1openSUSE-SU-2024:10726-1

  • dovecot Alpine 3.24, Alpine 3.23, Alpine 3.22 +14 more 2.3.1-r0
  • dovecot Alpine 3.7 2.2.34-r0

alpine advisories ALPINE-CVE-2017-14461

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • dovecot Arch Linux 2.3.0.1-1

arch linux advisories AVG-645

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2017-14461 updated cvss 5.9

dovecot: Information Leak Vulnerability in rfc822_parse_domain leading to denial-of-service

  • Red Hat Enterprise Linux 6 dovecot, dovecot-mysql, dovecot-pgsql, dovecot-pigeonhole Red Hat Enterprise Linux 7 dovecot, dovecot-mysql, dovecot-pgsql, dovecot-pigeonhole
    affected: no fix available
  • Red Hat Enterprise Linux 5 dovecot Red Hat Enterprise Linux 8 dovecot, dovecot-mysql, dovecot-pgsql, dovecot-pigeonhole
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

16.68% chance of exploitation in the next 30 days, higher than 97% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.0 5.9 CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:H
NVD 3.0 7.1 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H
NVD 2.0 5.5 AV:N/AC:L/Au:S/C:P/I:N/A:P

Affected products

  • The Dovecot Project Dovecot

Classification

Weakness
  • CWE-125 Out-of-bounds Read
  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.