CVE-2008-4577: Canonical Ubuntu Linux

High severity, CVSS 7.5. EPSS: 2.3% chance of exploitation in the next 30 days.

The ACL plugin in Dovecot before 1.1.4 treats negative access rights as if they are positive access rights, which allows attackers to bypass intended access restrictions.

Affected products

• Canonical Ubuntu Linux: version 8.04 only; version 8.10 only; version 9.04 only
• Dovecot Dovecot: before 1.1.4 (fixed in 1.1.4)
• Fedoraproject Fedora: version 8 only; version 9 only
• Opensuse Opensuse: version 10.3-11.1 only

Published 2008-10-15. Last modified 2026-06-16.