CVE-2010-3706

Priority
Description
plugins/acl/acl-backend-vfile.c in Dovecot 1.2.x before 1.2.15 and 2.0.x
before 2.0.5 interprets an ACL entry as a directive to add to the
permissions granted by another ACL entry, instead of a directive to replace
the permissions granted by another ACL entry, in certain circumstances
involving the private namespace of a user, which allows remote
authenticated users to bypass intended access restrictions via a request to
read or modify a mailbox.
Notes
 mdeslaur> seems to be introduced by this:
 mdeslaur> http://hg.dovecot.org/dovecot-1.2/rev/76ff6831c9ae
Package
Upstream:released (1.2.15, 2.0.5)
Patches:
Upstream:http://hg.dovecot.org/dovecot-1.2/rev/fd607e10e75d
More Information

Updated: 2019-03-19 11:55:17 UTC (commit 15472795df7e9de45b82f2d36b8b419b939f97b2)