In Dovecot before 2.2.36.3 and 2.3.x before 2.3.5.1, a local attacker can cause a buffer overflow in the indexer-worker process, which can be used to elevate to root. This occurs because of missing checks in the fts and pop3-uidl components.
Source: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-7524
Reference (s):
- BID:107672
- URL: http://www.securityfocus.com/bid/107672
- BUGTRAQ:20190328 [SECURITY] [DSA 4418-1] dovecot security update
- URL: https://seclists.org/bugtraq/2019/Mar/59
- DEBIAN:DSA-4418