CVE-2019-7524: Canonical Ubuntu Linux

High severity, CVSS 7.8. EPSS: 1.2% chance of exploitation in the next 30 days.

In Dovecot before 2.2.36.3 and 2.3.x before 2.3.5.1, a local attacker can cause a buffer overflow in the indexer-worker process, which can be used to elevate to root. This occurs because of missing checks in the fts and pop3-uidl components.

Affected products

• Canonical Ubuntu Linux: version 14.04 only; version 16.04 only; version 18.04 only; version 18.10 only
• Debian Debian Linux: version 8.0 only; version 9.0 only
• Dovecot Dovecot: before 2.2.36.3 (fixed in 2.2.36.3); from 2.3.0, before 2.3.5.1 (fixed in 2.3.5.1)
• Opensuse Leap: version 15.0 only; version 42.3 only

Published 2019-03-28. Last modified 2026-06-17.