OpenSMTPD prior to 6.6.4 allows remote code execution because of an out-of-bounds read in mta_io in mta_session.c for multi-line replies. Although this vulnerability affects the client side of OpenSMTPD, it is possible to attack a server because the server code launches the client code during bounce handling.
Vulnerable Product | Search on Vulmon | Subscribe to Product |
---|---|---|
opensmtpd opensmtpd |
||
canonical ubuntu linux 18.04 |
||
canonical ubuntu linux 19.10 |
||
fedoraproject fedora 31 |
||
fedoraproject fedora 32 |
||
debian debian linux 9.0 |
||
debian debian linux 10.0 |