Aki Tuomi

The issue is related to the improper neutralization of control and meta characters in the Dovecot mail server, allowing a remote attacker to access and compromise confidential data. By using IMAP IDLE, an authenticated attacker can trigger unhibernation via attacker-controlled parameters, leading to access to other users' email messages and path disclosure.

The issue is related to incorrect input validation in the Dovecot mail server, which can be exploited by a remote attacker. This exploitation can lead to a disruption in the authentication service due to an out-of-bounds read caused by sending a specially formatted NTLM request.

The issue allows remote attackers to cause a denial of service by aborting authentication without setting a username when the auth-policy is configured in the auth component.