debian/ruby-mail vulnerabilities

Latest debian/ruby-mail CVEs

Newest publication first

1. CVE-2015-9097 Mail Gem CRLF Injection vulnerability

   Published 2017-06-12

   Medium·CVSS 6.1

   The mail gem before 2.5.5 for Ruby (aka A Really Ruby Mail Library) is vulnerable to SMTP command injection via CRLF sequences in a RCPT TO or MAIL FROM command, as demonstrated by CRLF sequences immediately before and after a DATA substring.

2. CVE-2012-2139 Mail Gem Path Traversal vulnerability

   Published 2012-07-18

   Medium·CVSS 5.0

   Directory traversal vulnerability in lib/mail/network/delivery_methods/file_delivery.rb in the Mail gem before 2.4.4 for Ruby allows remote attackers to read arbitrary files via a .. (dot dot) in the to parameter.

3. CVE-2012-2140 Mail Gem Improper Input Validation vulnerability

   Published 2012-07-18

   High·CVSS 7.5

   The Mail gem before 2.4.3 for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a (1) sendmail or (2) exim delivery.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.