CVE-2019-7524: canonical ubuntu_linux
CVSS: 8.8v3.0HighModified
AliasesALPINE-CVE-2019-7524MGASA-2019-0141SUSE-SU-2019:0876-1UBUNTU-CVE-2019-7524USN-3928-1DEBIAN-CVE-2019-7524DLA-1736-1DSA-4418-1openSUSE-SU-2019:1212-1
Published 28-03-2019Last modified 04-08-2024
Vulnerability summary
CVE-2019-7524 is a high (CVSS 8.8) vulnerability in canonical ubuntu_linux. EPSS estimates a 1.18% chance of exploitation in the next 30 days, higher than 67.2% of scored vulnerabilities.
CVSS score
8.8/10
010
High · v3.0 (CVE.org)EPSS score
1.18%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 4 · Related 3Timeline
- 28-03-2019PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
In Dovecot before 2.2.36.3 and 2.3.x before 2.3.5.1, a local attacker can cause a buffer overflow in the indexer-worker process, which can be used to elevate to root. This occurs because of missing checks in the fts and pop3-uidl components.
CVSS metrics
6 scores · 5 sources · 2 versionsHigh 8.8Preferred score · CVE.org (CNA)
CVSS:3.0/AC:L/AV:L/A:H/C:H/I:H/PR:L/S:C/UI:NSources5 sources · 7.8–8.8
- OSV · AlpineEcosystem advisory · calculated7.8HighCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HDiffers
- OSV · UbuntuEcosystem advisory · calculated8.8HighCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated7.8HighCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HDiffers
- NVDNIST7.8HighCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HDiffers
High 7.2Preferred score · NVD (NIST)
AV:L/AC:L/Au:N/C:C/I:C/A:CSourcesSingle source
EPSS trend
Probability
1.18%
Chance of exploitation in the next 30 days
Percentile
67%
Versus all other CVEs
30-day change
0.00 pp
From 1.18% on 20-09-2026
20-09-202620-10-2026
EPSS score1.18%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Debian2 products
- dovecot< 1:2.3.4.1-3 | < 1:2.2.27-3+deb9u4 | < 1:2.2.13-12~deb8u6
- debian_linuxEOL8.0 | 9.0
Opensuse2 products
- leapEOL15.0 | 42.3
- dovecot23&distro=openSUSE Leap 15.0< 2.3.3-lp150.8.2
Alpine1 product
- dovecot≥ 2.3.0, < 2.3.5.1-r0 | ≥ 2.3.0, < 2.2.36.3-r0
Canonical1 product
- ubuntu_linuxEOL14.04 | 16.04 | 18.04 | 18.10
Dovecot1 product
- dovecot< 2.2.36.3 | ≥ 2.3.0, < 2.3.5.1
Mageia1 product
- dovecot< 2.2.36.3-1.mga6
Suse1 product
- dovecot23&distro=SUSE Linux Enterprise Module for Server Applications 15< 2.3.3-4.10.1
Ubuntu1 product
- dovecot< 1:2.2.9-1ubuntu2.6 | < 1:2.2.22-1ubuntu2.10 | < 1:2.2.33.2-1ubuntu4.3
8 vendors · 10 products
References
27 links
- lists.debian.org/debian-lts-announce/2019/03/msg00038.htmlMailing ListX Refsource MLISTThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2019-04/msg00060.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2019-04/msg00067.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
Show all 27 references
- lists.opensuse.org/archives/…Advisory