Orange

**Nome do software vulnerável e versões afetadas** Versões do Dovecot anteriores à 2.3.11.3 **Descrição** O problema está relacionado a uma validação incorreta de entradas no servidor de e-mail Dovecot. Ele pode ser explorado por um invasor remoto que envie uma solicitação RPA com formatação especial, levando a uma falha no serviço de autenticação. **Recomendações** Para versões anteriores à 2.3.11.3, atualize para a versão 2.3.11.3 ou posterior para resolver o problema. Como solução temporária, considere restringir o acesso à funcionalidade de solicitação RPA até que um patch seja aplicado.

**Name of the Vulnerable Software and Affected Versions** resolve-path versions prior to 1.4.0 **Description** The issue arises from a lack of validation of paths containing certain special characters in the resolve-path node module, allowing a malicious user to read the content of any file with a known path. This is due to a path traversal vulnerability. Specifically, the relative path resolving in resolve-path suffers from a lack of file path sanitization for Windows-based paths. **Recommendations** Update to version 1.4.0 or later.

**Name of the Vulnerable Software and Affected Versions** PHP versions 7.0.x through 7.0.26 PHP versions 7.1.x through 7.1.12 PHP versions 7.2.x through 7.2.0 **Description** The issue arises from inappropriately parsing an HTTP response, leading to a segmentation fault. This occurs because the `http header value` in ext/standard/http fopen wrapper.c can be a NULL value that is mishandled in an atoi call. The vulnerability is related to the `http header value` function and can be exploited by a remote attacker to cause a denial of service. **Recommendations** For PHP versions 7.0.x through 7.0.26, update to version 7.0.27 or later. For PHP versions 7.1.x through 7.1.12, update to version 7.1.13 or later. For PHP versions 7.2.x through 7.2.0, update to version 7.2.1 or later.