[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [ MDVSA-2008:232 ] dovecot

Good day.

Wed, Nov 19, 2008 at 02:00:00PM -0700, security@xxxxxxxxxxxx wrote:
>  The ACL plugin in dovecot prior to version 1.1.6 allowed attackers to
>  bypass intended access restrictions by using the 'k' right to create
>  unauthorized 'parent/child/child' mailboxes (CVE-2008-4578).

Are you really sure that it should be 1.1.6?  This bug is documented
in the 1.1.4 release notes,
and CVE entry speaks about 1.1.4 too.