Read the docs
TI-2006-05755 Aliases CVE-2006-5973GHSA-2xmp-j7gv-wmqh

Off-by-one buffer overflow in Dovecot 1.0test53 through 1.0.rc14, and possibly other…

Priority LOW 28Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · None · Partial
Fix status
No fix listed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA.

Summary

Off-by-one buffer overflow in Dovecot 1.0test53 through 1.0.rc14, and possibly other versions, when index files are used and mmap_disable is set to "yes," allows remote authenticated IMAP or POP3 users to cause a denial of service (crash) via unspecified vectors involving the cache file.

Why it matters now

EPSS 0.02864 86th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 57

CPEVersionsRoleVendor
cpe:2.3:a:timo_sirainen:dovecot:1.0:*:*:*:*:*:*:*1.0VulnerableTimo Sirainen
cpe:2.3:a:timo_sirainen:dovecot:1.0.alpha1:*:*:*:*:*:*:*1.0.alpha1VulnerableTimo Sirainen
cpe:2.3:a:timo_sirainen:dovecot:1.0.alpha2:*:*:*:*:*:*:*1.0.alpha2VulnerableTimo Sirainen
cpe:2.3:a:timo_sirainen:dovecot:1.0.alpha3:*:*:*:*:*:*:*1.0.alpha3VulnerableTimo Sirainen
cpe:2.3:a:timo_sirainen:dovecot:1.0.alpha4:*:*:*:*:*:*:*1.0.alpha4VulnerableTimo Sirainen
cpe:2.3:a:timo_sirainen:dovecot:1.0.alpha5:*:*:*:*:*:*:*1.0.alpha5VulnerableTimo Sirainen
cpe:2.3:a:timo_sirainen:dovecot:1.0.beta1:*:*:*:*:*:*:*1.0.beta1VulnerableTimo Sirainen
cpe:2.3:a:timo_sirainen:dovecot:1.0.beta2:*:*:*:*:*:*:*1.0.beta2VulnerableTimo Sirainen
cpe:2.3:a:timo_sirainen:dovecot:1.0.beta3:*:*:*:*:*:*:*1.0.beta3VulnerableTimo Sirainen
cpe:2.3:a:timo_sirainen:dovecot:1.0.beta4:*:*:*:*:*:*:*1.0.beta4VulnerableTimo Sirainen
  • cpe:2.3:a:timo_sirainen:dovecot:1.0:*:*:*:*:*:*:* Versions 1.0 Vulnerable ·Timo Sirainen
  • cpe:2.3:a:timo_sirainen:dovecot:1.0.alpha1:*:*:*:*:*:*:* Versions 1.0.alpha1 Vulnerable ·Timo Sirainen
  • cpe:2.3:a:timo_sirainen:dovecot:1.0.alpha2:*:*:*:*:*:*:* Versions 1.0.alpha2 Vulnerable ·Timo Sirainen
  • cpe:2.3:a:timo_sirainen:dovecot:1.0.alpha3:*:*:*:*:*:*:* Versions 1.0.alpha3 Vulnerable ·Timo Sirainen
  • cpe:2.3:a:timo_sirainen:dovecot:1.0.alpha4:*:*:*:*:*:*:* Versions 1.0.alpha4 Vulnerable ·Timo Sirainen
  • cpe:2.3:a:timo_sirainen:dovecot:1.0.alpha5:*:*:*:*:*:*:* Versions 1.0.alpha5 Vulnerable ·Timo Sirainen
  • cpe:2.3:a:timo_sirainen:dovecot:1.0.beta1:*:*:*:*:*:*:* Versions 1.0.beta1 Vulnerable ·Timo Sirainen
  • cpe:2.3:a:timo_sirainen:dovecot:1.0.beta2:*:*:*:*:*:*:* Versions 1.0.beta2 Vulnerable ·Timo Sirainen
  • cpe:2.3:a:timo_sirainen:dovecot:1.0.beta3:*:*:*:*:*:*:* Versions 1.0.beta3 Vulnerable ·Timo Sirainen
  • cpe:2.3:a:timo_sirainen:dovecot:1.0.beta4:*:*:*:*:*:*:* Versions 1.0.beta4 Vulnerable ·Timo Sirainen
Show 47 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:timo_sirainen:dovecot:1.0.beta5:*:*:*:*:*:*:*1.0.beta5VulnerableTimo Sirainen
cpe:2.3:a:timo_sirainen:dovecot:1.0.beta6:*:*:*:*:*:*:*1.0.beta6VulnerableTimo Sirainen
cpe:2.3:a:timo_sirainen:dovecot:1.0.beta7:*:*:*:*:*:*:*1.0.beta7VulnerableTimo Sirainen
cpe:2.3:a:timo_sirainen:dovecot:1.0.beta8:*:*:*:*:*:*:*1.0.beta8VulnerableTimo Sirainen
cpe:2.3:a:timo_sirainen:dovecot:1.0.beta9:*:*:*:*:*:*:*1.0.beta9VulnerableTimo Sirainen
cpe:2.3:a:timo_sirainen:dovecot:1.0.rc1:*:*:*:*:*:*:*1.0.rc1VulnerableTimo Sirainen
cpe:2.3:a:timo_sirainen:dovecot:1.0.rc2:*:*:*:*:*:*:*1.0.rc2VulnerableTimo Sirainen
cpe:2.3:a:timo_sirainen:dovecot:1.0.rc3:*:*:*:*:*:*:*1.0.rc3VulnerableTimo Sirainen
cpe:2.3:a:timo_sirainen:dovecot:1.0.rc4:*:*:*:*:*:*:*1.0.rc4VulnerableTimo Sirainen
cpe:2.3:a:timo_sirainen:dovecot:1.0.rc5:*:*:*:*:*:*:*1.0.rc5VulnerableTimo Sirainen
cpe:2.3:a:timo_sirainen:dovecot:1.0.rc6:*:*:*:*:*:*:*1.0.rc6VulnerableTimo Sirainen
cpe:2.3:a:timo_sirainen:dovecot:1.0.rc7:*:*:*:*:*:*:*1.0.rc7VulnerableTimo Sirainen
cpe:2.3:a:timo_sirainen:dovecot:1.0.rc8:*:*:*:*:*:*:*1.0.rc8VulnerableTimo Sirainen
cpe:2.3:a:timo_sirainen:dovecot:1.0.rc9:*:*:*:*:*:*:*1.0.rc9VulnerableTimo Sirainen
cpe:2.3:a:timo_sirainen:dovecot:1.0.rc10:*:*:*:*:*:*:*1.0.rc10VulnerableTimo Sirainen
cpe:2.3:a:timo_sirainen:dovecot:1.0.rc11:*:*:*:*:*:*:*1.0.rc11VulnerableTimo Sirainen
cpe:2.3:a:timo_sirainen:dovecot:1.0.rc12:*:*:*:*:*:*:*1.0.rc12VulnerableTimo Sirainen
cpe:2.3:a:timo_sirainen:dovecot:1.0.rc13:*:*:*:*:*:*:*1.0.rc13VulnerableTimo Sirainen
cpe:2.3:a:timo_sirainen:dovecot:1.0.rc14:*:*:*:*:*:*:*1.0.rc14VulnerableTimo Sirainen
cpe:2.3:a:timo_sirainen:dovecot:1.0.test53:*:*:*:*:*:*:*1.0.test53VulnerableTimo Sirainen
cpe:2.3:a:timo_sirainen:dovecot:1.0.test54:*:*:*:*:*:*:*1.0.test54VulnerableTimo Sirainen
cpe:2.3:a:timo_sirainen:dovecot:1.0.test55:*:*:*:*:*:*:*1.0.test55VulnerableTimo Sirainen
cpe:2.3:a:timo_sirainen:dovecot:1.0.test56:*:*:*:*:*:*:*1.0.test56VulnerableTimo Sirainen
cpe:2.3:a:timo_sirainen:dovecot:1.0.test57:*:*:*:*:*:*:*1.0.test57VulnerableTimo Sirainen
cpe:2.3:a:timo_sirainen:dovecot:1.0.test58:*:*:*:*:*:*:*1.0.test58VulnerableTimo Sirainen
cpe:2.3:a:timo_sirainen:dovecot:1.0.test59:*:*:*:*:*:*:*1.0.test59VulnerableTimo Sirainen
cpe:2.3:a:timo_sirainen:dovecot:1.0.test60:*:*:*:*:*:*:*1.0.test60VulnerableTimo Sirainen
cpe:2.3:a:timo_sirainen:dovecot:1.0.test61:*:*:*:*:*:*:*1.0.test61VulnerableTimo Sirainen
cpe:2.3:a:timo_sirainen:dovecot:1.0.test62:*:*:*:*:*:*:*1.0.test62VulnerableTimo Sirainen
cpe:2.3:a:timo_sirainen:dovecot:1.0.test63:*:*:*:*:*:*:*1.0.test63VulnerableTimo Sirainen
cpe:2.3:a:timo_sirainen:dovecot:1.0.test64:*:*:*:*:*:*:*1.0.test64VulnerableTimo Sirainen
cpe:2.3:a:timo_sirainen:dovecot:1.0.test65:*:*:*:*:*:*:*1.0.test65VulnerableTimo Sirainen
cpe:2.3:a:timo_sirainen:dovecot:1.0.test66:*:*:*:*:*:*:*1.0.test66VulnerableTimo Sirainen
cpe:2.3:a:timo_sirainen:dovecot:1.0.test67:*:*:*:*:*:*:*1.0.test67VulnerableTimo Sirainen
cpe:2.3:a:timo_sirainen:dovecot:1.0.test68:*:*:*:*:*:*:*1.0.test68VulnerableTimo Sirainen
cpe:2.3:a:timo_sirainen:dovecot:1.0.test69:*:*:*:*:*:*:*1.0.test69VulnerableTimo Sirainen
cpe:2.3:a:timo_sirainen:dovecot:1.0.test70:*:*:*:*:*:*:*1.0.test70VulnerableTimo Sirainen
cpe:2.3:a:timo_sirainen:dovecot:1.0.test71:*:*:*:*:*:*:*1.0.test71VulnerableTimo Sirainen
cpe:2.3:a:timo_sirainen:dovecot:1.0.test72:*:*:*:*:*:*:*1.0.test72VulnerableTimo Sirainen
cpe:2.3:a:timo_sirainen:dovecot:1.0.test73:*:*:*:*:*:*:*1.0.test73VulnerableTimo Sirainen
cpe:2.3:a:timo_sirainen:dovecot:1.0.test74:*:*:*:*:*:*:*1.0.test74VulnerableTimo Sirainen
cpe:2.3:a:timo_sirainen:dovecot:1.0.test75:*:*:*:*:*:*:*1.0.test75VulnerableTimo Sirainen
cpe:2.3:a:timo_sirainen:dovecot:1.0.test76:*:*:*:*:*:*:*1.0.test76VulnerableTimo Sirainen
cpe:2.3:a:timo_sirainen:dovecot:1.0.test77:*:*:*:*:*:*:*1.0.test77VulnerableTimo Sirainen
cpe:2.3:a:timo_sirainen:dovecot:1.0.test78:*:*:*:*:*:*:*1.0.test78VulnerableTimo Sirainen
cpe:2.3:a:timo_sirainen:dovecot:1.0.test79:*:*:*:*:*:*:*1.0.test79VulnerableTimo Sirainen
cpe:2.3:a:timo_sirainen:dovecot:1.0.test80:*:*:*:*:*:*:*1.0.test80VulnerableTimo Sirainen
  • cpe:2.3:a:timo_sirainen:dovecot:1.0.beta5:*:*:*:*:*:*:* Versions 1.0.beta5 Vulnerable ·Timo Sirainen
  • cpe:2.3:a:timo_sirainen:dovecot:1.0.beta6:*:*:*:*:*:*:* Versions 1.0.beta6 Vulnerable ·Timo Sirainen
  • cpe:2.3:a:timo_sirainen:dovecot:1.0.beta7:*:*:*:*:*:*:* Versions 1.0.beta7 Vulnerable ·Timo Sirainen
  • cpe:2.3:a:timo_sirainen:dovecot:1.0.beta8:*:*:*:*:*:*:* Versions 1.0.beta8 Vulnerable ·Timo Sirainen
  • cpe:2.3:a:timo_sirainen:dovecot:1.0.beta9:*:*:*:*:*:*:* Versions 1.0.beta9 Vulnerable ·Timo Sirainen
  • cpe:2.3:a:timo_sirainen:dovecot:1.0.rc1:*:*:*:*:*:*:* Versions 1.0.rc1 Vulnerable ·Timo Sirainen
  • cpe:2.3:a:timo_sirainen:dovecot:1.0.rc2:*:*:*:*:*:*:* Versions 1.0.rc2 Vulnerable ·Timo Sirainen
  • cpe:2.3:a:timo_sirainen:dovecot:1.0.rc3:*:*:*:*:*:*:* Versions 1.0.rc3 Vulnerable ·Timo Sirainen
  • cpe:2.3:a:timo_sirainen:dovecot:1.0.rc4:*:*:*:*:*:*:* Versions 1.0.rc4 Vulnerable ·Timo Sirainen
  • cpe:2.3:a:timo_sirainen:dovecot:1.0.rc5:*:*:*:*:*:*:* Versions 1.0.rc5 Vulnerable ·Timo Sirainen
  • cpe:2.3:a:timo_sirainen:dovecot:1.0.rc6:*:*:*:*:*:*:* Versions 1.0.rc6 Vulnerable ·Timo Sirainen
  • cpe:2.3:a:timo_sirainen:dovecot:1.0.rc7:*:*:*:*:*:*:* Versions 1.0.rc7 Vulnerable ·Timo Sirainen
  • cpe:2.3:a:timo_sirainen:dovecot:1.0.rc8:*:*:*:*:*:*:* Versions 1.0.rc8 Vulnerable ·Timo Sirainen
  • cpe:2.3:a:timo_sirainen:dovecot:1.0.rc9:*:*:*:*:*:*:* Versions 1.0.rc9 Vulnerable ·Timo Sirainen
  • cpe:2.3:a:timo_sirainen:dovecot:1.0.rc10:*:*:*:*:*:*:* Versions 1.0.rc10 Vulnerable ·Timo Sirainen
  • cpe:2.3:a:timo_sirainen:dovecot:1.0.rc11:*:*:*:*:*:*:* Versions 1.0.rc11 Vulnerable ·Timo Sirainen
  • cpe:2.3:a:timo_sirainen:dovecot:1.0.rc12:*:*:*:*:*:*:* Versions 1.0.rc12 Vulnerable ·Timo Sirainen
  • cpe:2.3:a:timo_sirainen:dovecot:1.0.rc13:*:*:*:*:*:*:* Versions 1.0.rc13 Vulnerable ·Timo Sirainen
  • cpe:2.3:a:timo_sirainen:dovecot:1.0.rc14:*:*:*:*:*:*:* Versions 1.0.rc14 Vulnerable ·Timo Sirainen
  • cpe:2.3:a:timo_sirainen:dovecot:1.0.test53:*:*:*:*:*:*:* Versions 1.0.test53 Vulnerable ·Timo Sirainen
  • cpe:2.3:a:timo_sirainen:dovecot:1.0.test54:*:*:*:*:*:*:* Versions 1.0.test54 Vulnerable ·Timo Sirainen
  • cpe:2.3:a:timo_sirainen:dovecot:1.0.test55:*:*:*:*:*:*:* Versions 1.0.test55 Vulnerable ·Timo Sirainen
  • cpe:2.3:a:timo_sirainen:dovecot:1.0.test56:*:*:*:*:*:*:* Versions 1.0.test56 Vulnerable ·Timo Sirainen
  • cpe:2.3:a:timo_sirainen:dovecot:1.0.test57:*:*:*:*:*:*:* Versions 1.0.test57 Vulnerable ·Timo Sirainen
  • cpe:2.3:a:timo_sirainen:dovecot:1.0.test58:*:*:*:*:*:*:* Versions 1.0.test58 Vulnerable ·Timo Sirainen
  • cpe:2.3:a:timo_sirainen:dovecot:1.0.test59:*:*:*:*:*:*:* Versions 1.0.test59 Vulnerable ·Timo Sirainen
  • cpe:2.3:a:timo_sirainen:dovecot:1.0.test60:*:*:*:*:*:*:* Versions 1.0.test60 Vulnerable ·Timo Sirainen
  • cpe:2.3:a:timo_sirainen:dovecot:1.0.test61:*:*:*:*:*:*:* Versions 1.0.test61 Vulnerable ·Timo Sirainen
  • cpe:2.3:a:timo_sirainen:dovecot:1.0.test62:*:*:*:*:*:*:* Versions 1.0.test62 Vulnerable ·Timo Sirainen
  • cpe:2.3:a:timo_sirainen:dovecot:1.0.test63:*:*:*:*:*:*:* Versions 1.0.test63 Vulnerable ·Timo Sirainen
  • cpe:2.3:a:timo_sirainen:dovecot:1.0.test64:*:*:*:*:*:*:* Versions 1.0.test64 Vulnerable ·Timo Sirainen
  • cpe:2.3:a:timo_sirainen:dovecot:1.0.test65:*:*:*:*:*:*:* Versions 1.0.test65 Vulnerable ·Timo Sirainen
  • cpe:2.3:a:timo_sirainen:dovecot:1.0.test66:*:*:*:*:*:*:* Versions 1.0.test66 Vulnerable ·Timo Sirainen
  • cpe:2.3:a:timo_sirainen:dovecot:1.0.test67:*:*:*:*:*:*:* Versions 1.0.test67 Vulnerable ·Timo Sirainen
  • cpe:2.3:a:timo_sirainen:dovecot:1.0.test68:*:*:*:*:*:*:* Versions 1.0.test68 Vulnerable ·Timo Sirainen
  • cpe:2.3:a:timo_sirainen:dovecot:1.0.test69:*:*:*:*:*:*:* Versions 1.0.test69 Vulnerable ·Timo Sirainen
  • cpe:2.3:a:timo_sirainen:dovecot:1.0.test70:*:*:*:*:*:*:* Versions 1.0.test70 Vulnerable ·Timo Sirainen
  • cpe:2.3:a:timo_sirainen:dovecot:1.0.test71:*:*:*:*:*:*:* Versions 1.0.test71 Vulnerable ·Timo Sirainen
  • cpe:2.3:a:timo_sirainen:dovecot:1.0.test72:*:*:*:*:*:*:* Versions 1.0.test72 Vulnerable ·Timo Sirainen
  • cpe:2.3:a:timo_sirainen:dovecot:1.0.test73:*:*:*:*:*:*:* Versions 1.0.test73 Vulnerable ·Timo Sirainen
  • cpe:2.3:a:timo_sirainen:dovecot:1.0.test74:*:*:*:*:*:*:* Versions 1.0.test74 Vulnerable ·Timo Sirainen
  • cpe:2.3:a:timo_sirainen:dovecot:1.0.test75:*:*:*:*:*:*:* Versions 1.0.test75 Vulnerable ·Timo Sirainen
  • cpe:2.3:a:timo_sirainen:dovecot:1.0.test76:*:*:*:*:*:*:* Versions 1.0.test76 Vulnerable ·Timo Sirainen
  • cpe:2.3:a:timo_sirainen:dovecot:1.0.test77:*:*:*:*:*:*:* Versions 1.0.test77 Vulnerable ·Timo Sirainen
  • cpe:2.3:a:timo_sirainen:dovecot:1.0.test78:*:*:*:*:*:*:* Versions 1.0.test78 Vulnerable ·Timo Sirainen
  • cpe:2.3:a:timo_sirainen:dovecot:1.0.test79:*:*:*:*:*:*:* Versions 1.0.test79 Vulnerable ·Timo Sirainen
  • cpe:2.3:a:timo_sirainen:dovecot:1.0.test80:*:*:*:*:*:*:* Versions 1.0.test80 Vulnerable ·Timo Sirainen

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2006-5973
  2. 2026-10-03 Alias added: GHSA-2xmp-j7gv-wmqh

References

Patch 1

Advisory 2

Other 3

  • TI-2006-02350 Directory traversal vulnerability in Dovecot 1.0 beta and 1.0 allows remote attackers to… CVSS 2.0MEDIUM 5.0
  • TI-2006-00709 Multiple unspecified vulnerabilities in Dovecot before 1.0beta3 allow remote attackers to… CVSS 2.0MEDIUM 5.0

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences