Published: 14/01/2020 Updated: 13/02/2023

CVSS v2 Base Score: 7.2 | Impact Score: 10 | Exploitability Score: 3.9

CVSS v3 Base Score: 7.8 | Impact Score: 5.9 | Exploitability Score: 1.8

VMScore: 641

Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C

BSD mailx 8.1.2 and previous versions allows remote malicious users to execute arbitrary commands via a crafted email address.

Vulnerable Product	Search on Vulmon	Subscribe to Product
redhat enterprise linux desktop 7.0
redhat enterprise linux workstation 7.0
redhat enterprise linux server 7.0
redhat enterprise linux server aus 6.6
redhat enterprise linux server eus 7.2
redhat enterprise linux desktop 6.0
redhat enterprise linux server 6.0
redhat enterprise linux workstation 6.0
redhat enterprise linux server tus 7.3
redhat enterprise linux server aus 7.3
redhat enterprise linux server aus 7.4
redhat enterprise linux server eus 7.3
redhat enterprise linux server eus 7.4
redhat enterprise linux server eus 7.5
redhat enterprise linux server tus 7.6
redhat enterprise linux server eus 7.6
redhat enterprise linux server aus 7.6
redhat enterprise linux server tus 6.6
redhat enterprise linux server eus 6.6
redhat enterprise linux server eus 7.7
redhat enterprise linux server aus 7.7
redhat enterprise linux server tus 7.7
debian debian linux 7.0
bsd mailx project bsd mailx 8.1.2

Synopsis Moderate: mailx security update Type/Severity Security Advisory: Moderate Topic Updated mailx packages that fix two security issues are now available forRed Hat Enterprise Linux 6 and 7Red Hat Product Security has rated this update as having Moderate securityimpact Common Vulnerability Scoring Sy ...

Debian Bug report logs - #773417 heirloom-mailx: CVE-2004-2771 CVE-2014-7844 Package: src:heirloom-mailx; Maintainer for src:heirloom-mailx is Hilko Bengen <bengen@debianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Thu, 18 Dec 2014 07:42:02 UTC Severity: grave Tags: security, upstream Found in ...

bsd-mailx could be made to run programs if it parsed a specially crafted email address ...

It was discovered that bsd-mailx, an implementation of the mail command, had an undocumented feature which treats syntactically valid email addresses as shell commands to execute Users who need this feature can re-enable it using the expandaddr in an appropriate mailrc file This update also removes the obsolete -T option An older security vulner ...

Two security vulnerabilities were discovered in Heirloom mailx, an implementation of the mail command: CVE-2004-2771 mailx interprets shell meta-characters in certain email addresses CVE-2014-7844 An unexpected feature of mailx treats syntactically valid email addresses as shell commands to execute Shell command execution can be ...

A flaw was found in the way mailx handled the parsing of email addresses A syntactically valid email address could allow a local attacker to cause mailx to execute arbitrary shell commands through shell meta-characters and the direct command execution functionality (CVE-2004-2771, CVE-2014-7844) Note: Applications using mailx to send email to add ...

Impact: Moderate Public Date: 2014-12-16 CWE: CWE-78 Bugzilla: 1162783: CVE-2004-2771 CVE-2014-7844 mai ...

CWE-74 http://www.debian.org/security/2014/dsa-3104 http://www.debian.org/security/2014/dsa-3105 http://seclists.org/oss-sec/2014/q4/1066 http://linux.oracle.com/errata/ELSA-2014-1999.html http://rhn.redhat.com/errata/RHSA-2014-1999.html https://access.redhat.com/errata/RHSA-2014:1999 https://usn.ubuntu.com/2455-1/https://nvd.nist.gov

CVE-2014-7844

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect