Published: 08/09/2014 Updated: 13/02/2023

CVSS v2 Base Score: 7.5 | Impact Score: 6.4 | Exploitability Score: 10

VMScore: 668

Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P

Heap-based buffer overflow in formisc.c in formail in procmail 3.22 allows remote malicious users to cause a denial of service (crash) and possibly execute arbitrary code via a crafted email header, related to "unbalanced quotes."

Vulnerable Product	Search on Vulmon	Subscribe to Product
procmail procmail 3.22
canonical ubuntu linux 14.04
canonical ubuntu linux 12.04
canonical ubuntu linux 10.04

Debian Bug report logs - #760443 procmail: CVE-2014-3618: Heap-overflow in formail when processing specially-crafted email headers Package: procmail; Maintainer for procmail is Santiago Vila <sanvila@debianorg>; Source for procmail is src:procmail (PTS, buildd, popcon) Reported by: Salvatore Bonaccorso <carnil@debianorg ...

formail could be made to crash or run programs if it processed specially crafted mail ...

Boris pi Piwinger and Tavis Ormandy reported a heap overflow vulnerability in procmail's formail utility when processing specially-crafted email headers A remote attacker could use this flaw to cause formail to crash, resulting in a denial of service or data loss, or possibly execute arbitrary code For the stable distribution (wheezy), this probl ...

A heap-based buffer overflow flaw was found in procmail's formail utility A remote attacker could send an email with specially crafted headers that, when processed by formail, could cause procmail to crash or, possibly, execute arbitrary code as the user running formail (CVE-2014-3618) ...

A heap-based buffer overflow flaw was found in procmail's formail utility A remote attacker could send an email with specially crafted headers that, when processed by formail, could cause procmail to crash or, possibly, execute arbitrary code as the user running formail ...

CWE-119 http://www.openwall.com/lists/oss-security/2014/09/03/8 http://www.debian.org/security/2014/dsa-3019 http://www.ubuntu.com/usn/USN-2340-1 http://www.securityfocus.com/bid/69573 http://lists.opensuse.org/opensuse-security-announce/2014-09/msg00008.html http://lists.opensuse.org/opensuse-security-announce/2014-09/msg00022.html http://rhn.redhat.com/errata/RHSA-2014-1172.html https://support.apple.com/HT205267 http://lists.apple.com/archives/security-announce/2015/Sep/msg00008.html http://secunia.com/advisories/61108 http://secunia.com/advisories/61090 http://secunia.com/advisories/61076 http://linux.oracle.com/errata/ELSA-2014-1172.html https://exchange.xforce.ibmcloud.com/vulnerabilities/95688 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=760443 https://usn.ubuntu.com/2340-1/https://nvd.nist.gov https://access.redhat.com/security/cve/cve-2014-3618

CVE-2014-3618

Vulnerability Summary

Vendor Advisories

References

Vulmon Search

About

Products

Connect