CVE-2017-16844 Heap-based buffer overflow in the loadbuf function in formisc.c in formail in procmail 3.22 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code....
CriticalCVSS 9.8
EPSS 12.2%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Heap-based buffer overflow in the loadbuf function in formisc.c in formail in procmail 3.22 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted e-mail message because of a hardcoded realloc size, a different vulnerability than CVE-2014-3618.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/procmail(Debian:12) | < 3.22-26 | 3.22-26 |
| debian/procmail(Debian:13) | < 3.22-26 | 3.22-26 |
| debian/procmail(Debian:14) | < 3.22-26 | 3.22-26 |
| procmail | = 3.22 | No fix listed |
References
- Debian Security Tracker CVE-2017-16844 vendor-advisory
- 1039844 third-party-advisory vdb-entry
- RHSA-2017:3269 third-party-advisory vendor-advisory
- bugs.debian.org issue-tracking third-party-advisory
- [debian-lts-announce] 20171118 [SECURITY] [DLA 1173-1] procmail security update mailing-list
- DSA-4041 third-party-advisory vendor-advisory
- bugs.debian.org issue-tracking