In Dovecot before 2.2.36.4 and 2.3.x before 2.3.7.2 (and Pigeonhole before 0.5.7.2), protocol processing can fail for quoted strings. This occurs because '\0' characters are mishandled, and can lead to out-of-bounds writes and remote code execution.
https://www.dovecot.org/security.html
https://security.gentoo.org/glsa/201908-29
https://lists.debian.org/debian-lts-announce/2019/08/msg00035.html
https://dovecot.org/pipermail/dovecot-news/2019-August/000417.html
https://access.redhat.com/errata/RHSA-2019:2885
https://access.redhat.com/errata/RHSA-2019:2836
https://access.redhat.com/errata/RHSA-2019:2822
http://www.openwall.com/lists/oss-security/2019/08/28/3
http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00026.html
http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00024.html