Search criteria

15 vulnerabilities found for spamassassin by spamassassin

CVE-2003-1557 (GCVE-0-2003-1557)

Vulnerability from cvelistv5 – Published: 2008-04-04 01:00 – Updated: 2024-08-08 02:35
VLAI?
Summary
Off-by-one buffer overflow in spamc of SpamAssassin 2.40 through 2.43, when using BSMTP mode ("-B"), allows remote attackers to execute arbitrary code via email containing headers with leading "." characters.
Severity ?
No CVSS data available.
CWE
  • n/a
Assigner
References
http://www.securityfocus.com/archive/1/309912/30/… vendor-advisoryx_refsource_GENTOO
http://www.securityfocus.com/bid/6679 vdb-entryx_refsource_BID
https://exchange.xforce.ibmcloud.com/vulnerabilit… vdb-entryx_refsource_XF
http://marc.info/?l=bugtraq&m=104342896818777&w=2 mailing-listx_refsource_BUGTRAQ
http://www.securityfocus.com/archive/1/310212/30/… mailing-listx_refsource_BUGTRAQ
http://secunia.com/advisories/7983 third-party-advisoryx_refsource_SECUNIA
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-08T02:35:17.606Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "GLSA-200302-01",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/309912/30/26090/threaded"
          },
          {
            "name": "6679",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/6679"
          },
          {
            "name": "spamassassin-spamc-offbyone-bo(11154)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/11154"
          },
          {
            "name": "20030123 SpamAssassin / spamc+BSMTP remote buffer overflow",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://marc.info/?l=bugtraq\u0026m=104342896818777\u0026w=2"
          },
          {
            "name": "20030204 Re: GLSA: Mail-SpamAssasin",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/310212/30/26030/threaded"
          },
          {
            "name": "7983",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/7983"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2003-01-23T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Off-by-one buffer overflow in spamc of SpamAssassin 2.40 through 2.43, when using BSMTP mode (\"-B\"), allows remote attackers to execute arbitrary code via email containing headers with leading \".\" characters."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-10-19T14:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "GLSA-200302-01",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "http://www.securityfocus.com/archive/1/309912/30/26090/threaded"
        },
        {
          "name": "6679",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/6679"
        },
        {
          "name": "spamassassin-spamc-offbyone-bo(11154)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/11154"
        },
        {
          "name": "20030123 SpamAssassin / spamc+BSMTP remote buffer overflow",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://marc.info/?l=bugtraq\u0026m=104342896818777\u0026w=2"
        },
        {
          "name": "20030204 Re: GLSA: Mail-SpamAssasin",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/310212/30/26030/threaded"
        },
        {
          "name": "7983",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/7983"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2003-1557",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Off-by-one buffer overflow in spamc of SpamAssassin 2.40 through 2.43, when using BSMTP mode (\"-B\"), allows remote attackers to execute arbitrary code via email containing headers with leading \".\" characters."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "GLSA-200302-01",
              "refsource": "GENTOO",
              "url": "http://www.securityfocus.com/archive/1/309912/30/26090/threaded"
            },
            {
              "name": "6679",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/6679"
            },
            {
              "name": "spamassassin-spamc-offbyone-bo(11154)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/11154"
            },
            {
              "name": "20030123 SpamAssassin / spamc+BSMTP remote buffer overflow",
              "refsource": "BUGTRAQ",
              "url": "http://marc.info/?l=bugtraq\u0026m=104342896818777\u0026w=2"
            },
            {
              "name": "20030204 Re: GLSA: Mail-SpamAssasin",
              "refsource": "BUGTRAQ",
              "url": "http://www.securityfocus.com/archive/1/310212/30/26030/threaded"
            },
            {
              "name": "7983",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/7983"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2003-1557",
    "datePublished": "2008-04-04T01:00:00",
    "dateReserved": "2008-04-03T00:00:00",
    "dateUpdated": "2024-08-08T02:35:17.606Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2007-2873 (GCVE-0-2007-2873)

Vulnerability from cvelistv5 – Published: 2007-06-11 23:00 – Updated: 2024-08-07 13:57
VLAI?
Summary
SpamAssassin 3.1.x, 3.2.0, and 3.2.1 before 20070611, when running as root in unusual configurations using vpopmail or virtual users, allows local users to cause a denial of service (corrupt arbitrary files) via a symlink attack on a file that is used by spamd.
Severity ?
No CVSS data available.
CWE
  • n/a
Assigner
References
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T13:57:54.658Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://issues.rpath.com/browse/RPL-1450"
          },
          {
            "name": "1018242",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id?1018242"
          },
          {
            "name": "ADV-2007-2172",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2007/2172"
          },
          {
            "name": "24481",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/24481"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://spamassassin.apache.org/advisories/cve-2007-2873.txt"
          },
          {
            "name": "oval:org.mitre.oval:def:10354",
            "tags": [
              "vdb-entry",
              "signature",
              "x_refsource_OVAL",
              "x_transferred"
            ],
            "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10354"
          },
          {
            "name": "MDKSA-2007:125",
            "tags": [
              "vendor-advisory",
              "x_refsource_MANDRIVA",
              "x_transferred"
            ],
            "url": "http://www.mandriva.com/security/advisories?name=MDKSA-2007:125"
          },
          {
            "name": "RHSA-2007:0492",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://www.redhat.com/support/errata/RHSA-2007-0492.html"
          },
          {
            "name": "37234",
            "tags": [
              "vdb-entry",
              "x_refsource_OSVDB",
              "x_transferred"
            ],
            "url": "http://osvdb.org/37234"
          },
          {
            "name": "spamassassin-symlink-dos(34864)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/34864"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2007-06-11T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "SpamAssassin 3.1.x, 3.2.0, and 3.2.1 before 20070611, when running as root in unusual configurations using vpopmail or virtual users, allows local users to cause a denial of service (corrupt arbitrary files) via a symlink attack on a file that is used by spamd."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-10-10T00:57:01",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://issues.rpath.com/browse/RPL-1450"
        },
        {
          "name": "1018242",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id?1018242"
        },
        {
          "name": "ADV-2007-2172",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2007/2172"
        },
        {
          "name": "24481",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/24481"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://spamassassin.apache.org/advisories/cve-2007-2873.txt"
        },
        {
          "name": "oval:org.mitre.oval:def:10354",
          "tags": [
            "vdb-entry",
            "signature",
            "x_refsource_OVAL"
          ],
          "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10354"
        },
        {
          "name": "MDKSA-2007:125",
          "tags": [
            "vendor-advisory",
            "x_refsource_MANDRIVA"
          ],
          "url": "http://www.mandriva.com/security/advisories?name=MDKSA-2007:125"
        },
        {
          "name": "RHSA-2007:0492",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://www.redhat.com/support/errata/RHSA-2007-0492.html"
        },
        {
          "name": "37234",
          "tags": [
            "vdb-entry",
            "x_refsource_OSVDB"
          ],
          "url": "http://osvdb.org/37234"
        },
        {
          "name": "spamassassin-symlink-dos(34864)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/34864"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2007-2873",
    "datePublished": "2007-06-11T23:00:00",
    "dateReserved": "2007-05-29T00:00:00",
    "dateUpdated": "2024-08-07T13:57:54.658Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2004-0796 (GCVE-0-2004-0796)

Vulnerability from cvelistv5 – Published: 2004-08-24 04:00 – Updated: 2024-08-08 00:31
VLAI?
Summary
SpamAssassin 2.5x, and 2.6x before 2.64, allows remote attackers to cause a denial of service via certain malformed messages.
Severity ?
No CVSS data available.
CWE
  • n/a
Assigner
References
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-08T00:31:46.848Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "GLSA-200408-06",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "http://security.gentoo.org/glsa/glsa-200408-06.xml"
          },
          {
            "name": "spamassassin-dos(16938)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/16938"
          },
          {
            "name": "10957",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/10957"
          },
          {
            "name": "MDKSA-2004:084",
            "tags": [
              "vendor-advisory",
              "x_refsource_MANDRAKE",
              "x_transferred"
            ],
            "url": "http://www.mandriva.com/security/advisories?name=MDKSA-2004:084"
          },
          {
            "name": "oval:org.mitre.oval:def:10413",
            "tags": [
              "vdb-entry",
              "signature",
              "x_refsource_OVAL",
              "x_transferred"
            ],
            "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10413"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=129337"
          },
          {
            "name": "[spamassassin-announce] 20040805 [SA-Announce] SpamAssassin 2.64 is released!",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://marc.info/?l=spamassassin-announce\u0026m=109168121628767\u0026w=2"
          },
          {
            "name": "FLSA:2268",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://bugzilla.fedora.us/show_bug.cgi?id=2268"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2004-08-05T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "SpamAssassin 2.5x, and 2.6x before 2.64, allows remote attackers to cause a denial of service via certain malformed messages."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-10-10T00:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "GLSA-200408-06",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "http://security.gentoo.org/glsa/glsa-200408-06.xml"
        },
        {
          "name": "spamassassin-dos(16938)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/16938"
        },
        {
          "name": "10957",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/10957"
        },
        {
          "name": "MDKSA-2004:084",
          "tags": [
            "vendor-advisory",
            "x_refsource_MANDRAKE"
          ],
          "url": "http://www.mandriva.com/security/advisories?name=MDKSA-2004:084"
        },
        {
          "name": "oval:org.mitre.oval:def:10413",
          "tags": [
            "vdb-entry",
            "signature",
            "x_refsource_OVAL"
          ],
          "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10413"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=129337"
        },
        {
          "name": "[spamassassin-announce] 20040805 [SA-Announce] SpamAssassin 2.64 is released!",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://marc.info/?l=spamassassin-announce\u0026m=109168121628767\u0026w=2"
        },
        {
          "name": "FLSA:2268",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://bugzilla.fedora.us/show_bug.cgi?id=2268"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2004-0796",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "SpamAssassin 2.5x, and 2.6x before 2.64, allows remote attackers to cause a denial of service via certain malformed messages."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "GLSA-200408-06",
              "refsource": "GENTOO",
              "url": "http://security.gentoo.org/glsa/glsa-200408-06.xml"
            },
            {
              "name": "spamassassin-dos(16938)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/16938"
            },
            {
              "name": "10957",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/10957"
            },
            {
              "name": "MDKSA-2004:084",
              "refsource": "MANDRAKE",
              "url": "http://www.mandriva.com/security/advisories?name=MDKSA-2004:084"
            },
            {
              "name": "oval:org.mitre.oval:def:10413",
              "refsource": "OVAL",
              "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10413"
            },
            {
              "name": "http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=129337",
              "refsource": "CONFIRM",
              "url": "http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=129337"
            },
            {
              "name": "[spamassassin-announce] 20040805 [SA-Announce] SpamAssassin 2.64 is released!",
              "refsource": "MLIST",
              "url": "http://marc.info/?l=spamassassin-announce\u0026m=109168121628767\u0026w=2"
            },
            {
              "name": "FLSA:2268",
              "refsource": "FEDORA",
              "url": "https://bugzilla.fedora.us/show_bug.cgi?id=2268"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2004-0796",
    "datePublished": "2004-08-24T04:00:00",
    "dateReserved": "2004-08-20T00:00:00",
    "dateUpdated": "2024-08-08T00:31:46.848Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2003-1557 (GCVE-0-2003-1557)

Vulnerability from nvd – Published: 2008-04-04 01:00 – Updated: 2024-08-08 02:35
VLAI?
Summary
Off-by-one buffer overflow in spamc of SpamAssassin 2.40 through 2.43, when using BSMTP mode ("-B"), allows remote attackers to execute arbitrary code via email containing headers with leading "." characters.
Severity ?
No CVSS data available.
CWE
  • n/a
Assigner
References
http://www.securityfocus.com/archive/1/309912/30/… vendor-advisoryx_refsource_GENTOO
http://www.securityfocus.com/bid/6679 vdb-entryx_refsource_BID
https://exchange.xforce.ibmcloud.com/vulnerabilit… vdb-entryx_refsource_XF
http://marc.info/?l=bugtraq&m=104342896818777&w=2 mailing-listx_refsource_BUGTRAQ
http://www.securityfocus.com/archive/1/310212/30/… mailing-listx_refsource_BUGTRAQ
http://secunia.com/advisories/7983 third-party-advisoryx_refsource_SECUNIA
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-08T02:35:17.606Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "GLSA-200302-01",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/309912/30/26090/threaded"
          },
          {
            "name": "6679",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/6679"
          },
          {
            "name": "spamassassin-spamc-offbyone-bo(11154)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/11154"
          },
          {
            "name": "20030123 SpamAssassin / spamc+BSMTP remote buffer overflow",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://marc.info/?l=bugtraq\u0026m=104342896818777\u0026w=2"
          },
          {
            "name": "20030204 Re: GLSA: Mail-SpamAssasin",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/310212/30/26030/threaded"
          },
          {
            "name": "7983",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/7983"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2003-01-23T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Off-by-one buffer overflow in spamc of SpamAssassin 2.40 through 2.43, when using BSMTP mode (\"-B\"), allows remote attackers to execute arbitrary code via email containing headers with leading \".\" characters."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-10-19T14:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "GLSA-200302-01",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "http://www.securityfocus.com/archive/1/309912/30/26090/threaded"
        },
        {
          "name": "6679",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/6679"
        },
        {
          "name": "spamassassin-spamc-offbyone-bo(11154)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/11154"
        },
        {
          "name": "20030123 SpamAssassin / spamc+BSMTP remote buffer overflow",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://marc.info/?l=bugtraq\u0026m=104342896818777\u0026w=2"
        },
        {
          "name": "20030204 Re: GLSA: Mail-SpamAssasin",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/310212/30/26030/threaded"
        },
        {
          "name": "7983",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/7983"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2003-1557",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Off-by-one buffer overflow in spamc of SpamAssassin 2.40 through 2.43, when using BSMTP mode (\"-B\"), allows remote attackers to execute arbitrary code via email containing headers with leading \".\" characters."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "GLSA-200302-01",
              "refsource": "GENTOO",
              "url": "http://www.securityfocus.com/archive/1/309912/30/26090/threaded"
            },
            {
              "name": "6679",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/6679"
            },
            {
              "name": "spamassassin-spamc-offbyone-bo(11154)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/11154"
            },
            {
              "name": "20030123 SpamAssassin / spamc+BSMTP remote buffer overflow",
              "refsource": "BUGTRAQ",
              "url": "http://marc.info/?l=bugtraq\u0026m=104342896818777\u0026w=2"
            },
            {
              "name": "20030204 Re: GLSA: Mail-SpamAssasin",
              "refsource": "BUGTRAQ",
              "url": "http://www.securityfocus.com/archive/1/310212/30/26030/threaded"
            },
            {
              "name": "7983",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/7983"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2003-1557",
    "datePublished": "2008-04-04T01:00:00",
    "dateReserved": "2008-04-03T00:00:00",
    "dateUpdated": "2024-08-08T02:35:17.606Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2007-2873 (GCVE-0-2007-2873)

Vulnerability from nvd – Published: 2007-06-11 23:00 – Updated: 2024-08-07 13:57
VLAI?
Summary
SpamAssassin 3.1.x, 3.2.0, and 3.2.1 before 20070611, when running as root in unusual configurations using vpopmail or virtual users, allows local users to cause a denial of service (corrupt arbitrary files) via a symlink attack on a file that is used by spamd.
Severity ?
No CVSS data available.
CWE
  • n/a
Assigner
References
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T13:57:54.658Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://issues.rpath.com/browse/RPL-1450"
          },
          {
            "name": "1018242",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id?1018242"
          },
          {
            "name": "ADV-2007-2172",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2007/2172"
          },
          {
            "name": "24481",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/24481"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://spamassassin.apache.org/advisories/cve-2007-2873.txt"
          },
          {
            "name": "oval:org.mitre.oval:def:10354",
            "tags": [
              "vdb-entry",
              "signature",
              "x_refsource_OVAL",
              "x_transferred"
            ],
            "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10354"
          },
          {
            "name": "MDKSA-2007:125",
            "tags": [
              "vendor-advisory",
              "x_refsource_MANDRIVA",
              "x_transferred"
            ],
            "url": "http://www.mandriva.com/security/advisories?name=MDKSA-2007:125"
          },
          {
            "name": "RHSA-2007:0492",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://www.redhat.com/support/errata/RHSA-2007-0492.html"
          },
          {
            "name": "37234",
            "tags": [
              "vdb-entry",
              "x_refsource_OSVDB",
              "x_transferred"
            ],
            "url": "http://osvdb.org/37234"
          },
          {
            "name": "spamassassin-symlink-dos(34864)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/34864"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2007-06-11T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "SpamAssassin 3.1.x, 3.2.0, and 3.2.1 before 20070611, when running as root in unusual configurations using vpopmail or virtual users, allows local users to cause a denial of service (corrupt arbitrary files) via a symlink attack on a file that is used by spamd."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-10-10T00:57:01",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://issues.rpath.com/browse/RPL-1450"
        },
        {
          "name": "1018242",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id?1018242"
        },
        {
          "name": "ADV-2007-2172",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2007/2172"
        },
        {
          "name": "24481",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/24481"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://spamassassin.apache.org/advisories/cve-2007-2873.txt"
        },
        {
          "name": "oval:org.mitre.oval:def:10354",
          "tags": [
            "vdb-entry",
            "signature",
            "x_refsource_OVAL"
          ],
          "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10354"
        },
        {
          "name": "MDKSA-2007:125",
          "tags": [
            "vendor-advisory",
            "x_refsource_MANDRIVA"
          ],
          "url": "http://www.mandriva.com/security/advisories?name=MDKSA-2007:125"
        },
        {
          "name": "RHSA-2007:0492",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://www.redhat.com/support/errata/RHSA-2007-0492.html"
        },
        {
          "name": "37234",
          "tags": [
            "vdb-entry",
            "x_refsource_OSVDB"
          ],
          "url": "http://osvdb.org/37234"
        },
        {
          "name": "spamassassin-symlink-dos(34864)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/34864"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2007-2873",
    "datePublished": "2007-06-11T23:00:00",
    "dateReserved": "2007-05-29T00:00:00",
    "dateUpdated": "2024-08-07T13:57:54.658Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2004-0796 (GCVE-0-2004-0796)

Vulnerability from nvd – Published: 2004-08-24 04:00 – Updated: 2024-08-08 00:31
VLAI?
Summary
SpamAssassin 2.5x, and 2.6x before 2.64, allows remote attackers to cause a denial of service via certain malformed messages.
Severity ?
No CVSS data available.
CWE
  • n/a
Assigner
References
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-08T00:31:46.848Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "GLSA-200408-06",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "http://security.gentoo.org/glsa/glsa-200408-06.xml"
          },
          {
            "name": "spamassassin-dos(16938)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/16938"
          },
          {
            "name": "10957",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/10957"
          },
          {
            "name": "MDKSA-2004:084",
            "tags": [
              "vendor-advisory",
              "x_refsource_MANDRAKE",
              "x_transferred"
            ],
            "url": "http://www.mandriva.com/security/advisories?name=MDKSA-2004:084"
          },
          {
            "name": "oval:org.mitre.oval:def:10413",
            "tags": [
              "vdb-entry",
              "signature",
              "x_refsource_OVAL",
              "x_transferred"
            ],
            "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10413"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=129337"
          },
          {
            "name": "[spamassassin-announce] 20040805 [SA-Announce] SpamAssassin 2.64 is released!",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://marc.info/?l=spamassassin-announce\u0026m=109168121628767\u0026w=2"
          },
          {
            "name": "FLSA:2268",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://bugzilla.fedora.us/show_bug.cgi?id=2268"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2004-08-05T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "SpamAssassin 2.5x, and 2.6x before 2.64, allows remote attackers to cause a denial of service via certain malformed messages."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-10-10T00:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "GLSA-200408-06",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "http://security.gentoo.org/glsa/glsa-200408-06.xml"
        },
        {
          "name": "spamassassin-dos(16938)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/16938"
        },
        {
          "name": "10957",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/10957"
        },
        {
          "name": "MDKSA-2004:084",
          "tags": [
            "vendor-advisory",
            "x_refsource_MANDRAKE"
          ],
          "url": "http://www.mandriva.com/security/advisories?name=MDKSA-2004:084"
        },
        {
          "name": "oval:org.mitre.oval:def:10413",
          "tags": [
            "vdb-entry",
            "signature",
            "x_refsource_OVAL"
          ],
          "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10413"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=129337"
        },
        {
          "name": "[spamassassin-announce] 20040805 [SA-Announce] SpamAssassin 2.64 is released!",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://marc.info/?l=spamassassin-announce\u0026m=109168121628767\u0026w=2"
        },
        {
          "name": "FLSA:2268",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://bugzilla.fedora.us/show_bug.cgi?id=2268"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2004-0796",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "SpamAssassin 2.5x, and 2.6x before 2.64, allows remote attackers to cause a denial of service via certain malformed messages."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "GLSA-200408-06",
              "refsource": "GENTOO",
              "url": "http://security.gentoo.org/glsa/glsa-200408-06.xml"
            },
            {
              "name": "spamassassin-dos(16938)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/16938"
            },
            {
              "name": "10957",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/10957"
            },
            {
              "name": "MDKSA-2004:084",
              "refsource": "MANDRAKE",
              "url": "http://www.mandriva.com/security/advisories?name=MDKSA-2004:084"
            },
            {
              "name": "oval:org.mitre.oval:def:10413",
              "refsource": "OVAL",
              "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10413"
            },
            {
              "name": "http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=129337",
              "refsource": "CONFIRM",
              "url": "http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=129337"
            },
            {
              "name": "[spamassassin-announce] 20040805 [SA-Announce] SpamAssassin 2.64 is released!",
              "refsource": "MLIST",
              "url": "http://marc.info/?l=spamassassin-announce\u0026m=109168121628767\u0026w=2"
            },
            {
              "name": "FLSA:2268",
              "refsource": "FEDORA",
              "url": "https://bugzilla.fedora.us/show_bug.cgi?id=2268"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2004-0796",
    "datePublished": "2004-08-24T04:00:00",
    "dateReserved": "2004-08-20T00:00:00",
    "dateUpdated": "2024-08-08T00:31:46.848Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CERTA-2007-AVI-268

Vulnerability from certfr_avis - Published: - Updated:

Une vulnérabilité dans le logiciel SpamAssassin permet à un utilisateur localement connecté et dont la messagerie électronique est filtrée par ce logiciel de modifier arbitraitement des fichiers accessibles par SpamAssassin.

Description

Le logiciel SpamAssassin filtre les courriels non sollicités. Il est affecté par une vulnérabilité permettant à un utilisateur localement connecté et dont la messagerie électronique est filtrée, de modifier arbitraitement des fichiers accessibles par SpamAssassin. La modification des données permet à l'attaquant de réaliser un déni de service.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None
Impacted products
Vendor Product Description
SpamAssassin SpamAssassin SpamAssassin 3.1.x;
SpamAssassin SpamAssassin SpamAssassin 3.2.0;
SpamAssassin SpamAssassin SpamAssassin version en cours de dévelopement.
References

Show details on source website
To clipboard 

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "SpamAssassin 3.1.x;",
      "product": {
        "name": "SpamAssassin",
        "vendor": {
          "name": "SpamAssassin",
          "scada": false
        }
      }
    },
    {
      "description": "SpamAssassin 3.2.0;",
      "product": {
        "name": "SpamAssassin",
        "vendor": {
          "name": "SpamAssassin",
          "scada": false
        }
      }
    },
    {
      "description": "SpamAssassin version en cours de d\u00e9velopement.",
      "product": {
        "name": "SpamAssassin",
        "vendor": {
          "name": "SpamAssassin",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Description\n\nLe logiciel SpamAssassin filtre les courriels non sollicit\u00e9s. Il est\naffect\u00e9 par une vuln\u00e9rabilit\u00e9 permettant \u00e0 un utilisateur localement\nconnect\u00e9 et dont la messagerie \u00e9lectronique est filtr\u00e9e, de modifier\narbitraitement des fichiers accessibles par SpamAssassin. La\nmodification des donn\u00e9es permet \u00e0 l\u0027attaquant de r\u00e9aliser un d\u00e9ni de\nservice.\n\n## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2007-2873",
      "url": "https://www.cve.org/CVERecord?id=CVE-2007-2873"
    }
  ],
  "links": [
    {
      "title": "Bulletin de s\u00e9curit\u00e9 de Apache SpamAssassin CVE-2007-2873 :",
      "url": "http://spamassassin.apache.org/advisories/cve-2007-2873.txt"
    }
  ],
  "reference": "CERTA-2007-AVI-268",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2007-06-18T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 dans le logiciel \u003cspan\nclass=\"textit\"\u003eSpamAssassin\u003c/span\u003e permet \u00e0 un utilisateur localement\nconnect\u00e9 et dont la messagerie \u00e9lectronique est filtr\u00e9e par ce logiciel\nde modifier arbitraitement des fichiers accessibles par \u003cspan\nclass=\"textit\"\u003eSpamAssassin\u003c/span\u003e.\n",
  "title": "Vuln\u00e9rabilit\u00e9 dans Apache SpamAssassin",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 de Apache SpamAssassin cve-2007-2873",
      "url": null
    }
  ]
}

CERTA-2007-AVI-094

Vulnerability from certfr_avis - Published: - Updated:

Une vulnérabilité présente dans SpamAssassin permet de réaliser un déni de service.

Description

Une vulnérabilité dans le traitement des adresses réticulaires présentes à l'intérieur des messages permet à un utilisateur distant de réaliser un déni de service par le biais d'un message spécialement conçu.

Solution

La version 3.1.8 de SpamAssassin corrige le problème.

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None
Impacted products
Vendor Product Description
SpamAssassin SpamAssassin SpamAssassin versions 3.1.x.
References

Show details on source website
To clipboard 

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "SpamAssassin versions 3.1.x.",
      "product": {
        "name": "SpamAssassin",
        "vendor": {
          "name": "SpamAssassin",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Description\n\nUne vuln\u00e9rabilit\u00e9 dans le traitement des adresses r\u00e9ticulaires pr\u00e9sentes\n\u00e0 l\u0027int\u00e9rieur des messages permet \u00e0 un utilisateur distant de r\u00e9aliser\nun d\u00e9ni de service par le biais d\u0027un message sp\u00e9cialement con\u00e7u.\n\n## Solution\n\nLa version 3.1.8 de SpamAssassin corrige le probl\u00e8me.\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2007-0451",
      "url": "https://www.cve.org/CVERecord?id=CVE-2007-0451"
    }
  ],
  "links": [
    {
      "title": "Mise \u00e0 jour de s\u00e9curit\u00e9 Fedora 5 :",
      "url": "http://fedoranews.org/cms/node/2657"
    },
    {
      "title": "Mise \u00e0 jour de s\u00e9curit\u00e9 Red Hat :",
      "url": "http://rhn.redhat.com/errata/RHSA-2007-0074.html"
    },
    {
      "title": "Mise \u00e0 jour de s\u00e9curit\u00e9 Gentoo :",
      "url": "http://www.gentoo.org/security/en/glsa/glsa-200703-02.xml"
    },
    {
      "title": "Mise \u00e0 jour de s\u00e9curit\u00e9 Fedora 6 :",
      "url": "http://fedoranews.org/cms/node/2659"
    },
    {
      "title": "Mise \u00e0 jour de s\u00e9curit\u00e9 Mandriva :",
      "url": "http://www.mandriva.com/security/advisories?name=MDKSA-2007:049"
    }
  ],
  "reference": "CERTA-2007-AVI-094",
  "revisions": [
    {
      "description": "version initiale ;",
      "revision_date": "2007-02-16T00:00:00.000000"
    },
    {
      "description": "ajout des mises \u00e0 jour de s\u00e9curit\u00e9 Gentoo, Fedora, Mandriva, Red Hat.",
      "revision_date": "2007-03-13T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 pr\u00e9sente dans SpamAssassin permet de r\u00e9aliser un d\u00e9ni\nde service.\n",
  "title": "Vuln\u00e9rabilit\u00e9 dans SpamAssassin",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Annonce de SpamAssassin 3.1.8 du 13 f\u00e9vrier 2007",
      "url": "http://svn.apache.org/repos/asf/spamassassin/branches/3.1/build/announcements/3.1.8.txt"
    }
  ]
}

CERTA-2006-AVI-234

Vulnerability from certfr_avis - Published: - Updated:

Une vulnérabilité a été publiée dans le logiciel anti-spam SpamAssassin. Elle permet l'éxécution de code arbitraire à distance.

Description

Pour que la vulnérabilité soit mise en oeuvre il est nécessaire que les directives -vpopmail et -paranoid soit activées dans le fichier de configuration. Il est à noter qu'il ne s'agit pas de la configuration par défaut.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None
Impacted products
Vendor Product Description
SpamAssassin SpamAssassin 3.1.x.
SpamAssassin SpamAssassin 3.0.x;
SpamAssassin SpamAssassin 2.6.x;
SpamAssassin SpamAssassin 2.5.x;
References

Show details on source website
To clipboard 

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "3.1.x.",
      "product": {
        "name": "SpamAssassin",
        "vendor": {
          "name": "SpamAssassin",
          "scada": false
        }
      }
    },
    {
      "description": "3.0.x;",
      "product": {
        "name": "SpamAssassin",
        "vendor": {
          "name": "SpamAssassin",
          "scada": false
        }
      }
    },
    {
      "description": "2.6.x;",
      "product": {
        "name": "SpamAssassin",
        "vendor": {
          "name": "SpamAssassin",
          "scada": false
        }
      }
    },
    {
      "description": "2.5.x;",
      "product": {
        "name": "SpamAssassin",
        "vendor": {
          "name": "SpamAssassin",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Description\n\nPour que la vuln\u00e9rabilit\u00e9 soit mise en oeuvre il est n\u00e9cessaire que les\ndirectives -vpopmail et -paranoid soit activ\u00e9es dans le fichier de\nconfiguration. Il est \u00e0 noter qu\u0027il ne s\u0027agit pas de la configuration\npar d\u00e9faut.\n\n## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [],
  "links": [
    {
      "title": "Bulletin de s\u00e9curit\u00e9 RedHat RHSA-2006:0543 du 06 juin 2006    :",
      "url": "http://rhn.redhat.com/errata/RHSA-2006-0543.html"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 Gentoo GLSA-200606-09 du 11 juin 2006    :",
      "url": "http://www.gentoo.org/security/en/glsa/glsa-200606-09.xml"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 Mandriva MDKSA-2006:103 du 14 juin    2006 :",
      "url": "http://www.mandriva.com/security/advisories?name=MDKSA-2006:103"
    },
    {
      "title": "Nouvelle version de SpamAssassin",
      "url": "http://spamassassin.apache.org/downloads.cgi?update=200606050750"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 Debian DSA-1090 du 06 juin 2006 :",
      "url": "http://www.debian.org/security/2006/dsa-1090"
    }
  ],
  "reference": "CERTA-2006-AVI-234",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2006-06-12T00:00:00.000000"
    },
    {
      "description": "ajout des r\u00e9f\u00e9rences aux bulletins de s\u00e9curit\u00e9 Debian, RedHat, Gentoo et Mandriva.",
      "revision_date": "2006-06-27T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 publi\u00e9e dans le logiciel anti-spam SpamAssassin.\nElle permet l\u0027\u00e9x\u00e9cution de code arbitraire \u00e0 distance.\n",
  "title": "Vuln\u00e9rabilit\u00e9s dans SpamAssassin",
  "vendor_advisories": []
}

FKIE_CVE-2007-2873

Vulnerability from fkie_nvd - Published: 2007-06-11 23:30 - Updated: 2025-04-09 00:30
Severity ?
Summary
SpamAssassin 3.1.x, 3.2.0, and 3.2.1 before 20070611, when running as root in unusual configurations using vpopmail or virtual users, allows local users to cause a denial of service (corrupt arbitrary files) via a symlink attack on a file that is used by spamd.
References
secalert@redhat.comhttp://osvdb.org/37234
secalert@redhat.comhttp://spamassassin.apache.org/advisories/cve-2007-2873.txt
secalert@redhat.comhttp://www.mandriva.com/security/advisories?name=MDKSA-2007:125
secalert@redhat.comhttp://www.redhat.com/support/errata/RHSA-2007-0492.html
secalert@redhat.comhttp://www.securityfocus.com/bid/24481
secalert@redhat.comhttp://www.securitytracker.com/id?1018242
secalert@redhat.comhttp://www.vupen.com/english/advisories/2007/2172
secalert@redhat.comhttps://exchange.xforce.ibmcloud.com/vulnerabilities/34864
secalert@redhat.comhttps://issues.rpath.com/browse/RPL-1450
secalert@redhat.comhttps://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10354
af854a3a-2127-422b-91ae-364da2661108http://osvdb.org/37234
af854a3a-2127-422b-91ae-364da2661108http://spamassassin.apache.org/advisories/cve-2007-2873.txt
af854a3a-2127-422b-91ae-364da2661108http://www.mandriva.com/security/advisories?name=MDKSA-2007:125
af854a3a-2127-422b-91ae-364da2661108http://www.redhat.com/support/errata/RHSA-2007-0492.html
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/24481
af854a3a-2127-422b-91ae-364da2661108http://www.securitytracker.com/id?1018242
af854a3a-2127-422b-91ae-364da2661108http://www.vupen.com/english/advisories/2007/2172
af854a3a-2127-422b-91ae-364da2661108https://exchange.xforce.ibmcloud.com/vulnerabilities/34864
af854a3a-2127-422b-91ae-364da2661108https://issues.rpath.com/browse/RPL-1450
af854a3a-2127-422b-91ae-364da2661108https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10354
Impacted products
Vendor Product Version
spamassassin spamassassin 3.1.0
spamassassin spamassassin 3.1.1
spamassassin spamassassin 3.1.2
spamassassin spamassassin 3.1.3
spamassassin spamassassin 3.1.4
spamassassin spamassassin 3.1.5
spamassassin spamassassin 3.1.6
spamassassin spamassassin 3.1.7
spamassassin spamassassin 3.1.8
spamassassin spamassassin 3.1.9
spamassassin spamassassin 3.2.0
spamassassin spamassassin 3.2.1
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:spamassassin:spamassassin:3.1.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "4F616F8E-1B02-426D-B374-626670FFEE24",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:spamassassin:spamassassin:3.1.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "E97D6EBA-6DB9-4165-8BBB-17E9F49A6748",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:spamassassin:spamassassin:3.1.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "4C60F596-D3BA-42F6-BFD0-3A7F469449B0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:spamassassin:spamassassin:3.1.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "69E3D03E-5578-47AB-ACA7-51D792E36F27",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:spamassassin:spamassassin:3.1.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "7C481915-8F44-4D7F-AFA3-FE1CC4BD876D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:spamassassin:spamassassin:3.1.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "D2D21D3D-E250-49FE-9075-F2DBA57F5550",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:spamassassin:spamassassin:3.1.6:*:*:*:*:*:*:*",
              "matchCriteriaId": "9F1CF488-8074-4AEA-B7DB-E966E7D23B80",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:spamassassin:spamassassin:3.1.7:*:*:*:*:*:*:*",
              "matchCriteriaId": "F92E7329-EA19-4FE5-AAD0-ACA3E7497766",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:spamassassin:spamassassin:3.1.8:*:*:*:*:*:*:*",
              "matchCriteriaId": "B4F0FD10-EFCA-46BD-ACD9-E04A0F65B5C4",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:spamassassin:spamassassin:3.1.9:*:*:*:*:*:*:*",
              "matchCriteriaId": "FA80E97B-6FD1-4655-9C29-302FA60C6345",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:spamassassin:spamassassin:3.2.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "EF487853-FE1A-47A8-8E60-8A6D2E0284E1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:spamassassin:spamassassin:3.2.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "FCF23DBD-FE7A-4940-8F6C-B13E5DDEFC7F",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "SpamAssassin 3.1.x, 3.2.0, and 3.2.1 before 20070611, when running as root in unusual configurations using vpopmail or virtual users, allows local users to cause a denial of service (corrupt arbitrary files) via a symlink attack on a file that is used by spamd."
    },
    {
      "lang": "es",
      "value": "SpamAssassin 3.1.x, 3.2.0, y 3.2.1 anterior a 20070611, cuando funciona como root en configuraciones habituales utilizando usuarios vpopmail o virtuales, permite a usuarios locales provocar denegaci\u00f3n de servicio (archivos de su elecci\u00f3n corruptos) a trav\u00e9s de un ataque de enlace simb\u00f3lico sobre un fichero que es utlizada por spamd."
    }
  ],
  "id": "CVE-2007-2873",
  "lastModified": "2025-04-09T00:30:58.490",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "LOW",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "LOCAL",
          "authentication": "NONE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 1.9,
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "vectorString": "AV:L/AC:M/Au:N/C:N/I:N/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 3.4,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ]
  },
  "published": "2007-06-11T23:30:00.000",
  "references": [
    {
      "source": "secalert@redhat.com",
      "url": "http://osvdb.org/37234"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://spamassassin.apache.org/advisories/cve-2007-2873.txt"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://www.mandriva.com/security/advisories?name=MDKSA-2007:125"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://www.redhat.com/support/errata/RHSA-2007-0492.html"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://www.securityfocus.com/bid/24481"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://www.securitytracker.com/id?1018242"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://www.vupen.com/english/advisories/2007/2172"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/34864"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://issues.rpath.com/browse/RPL-1450"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10354"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://osvdb.org/37234"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://spamassassin.apache.org/advisories/cve-2007-2873.txt"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.mandriva.com/security/advisories?name=MDKSA-2007:125"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.redhat.com/support/errata/RHSA-2007-0492.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/bid/24481"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securitytracker.com/id?1018242"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.vupen.com/english/advisories/2007/2172"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/34864"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://issues.rpath.com/browse/RPL-1450"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10354"
    }
  ],
  "sourceIdentifier": "secalert@redhat.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

FKIE_CVE-2004-0796

Vulnerability from fkie_nvd - Published: 2004-10-20 04:00 - Updated: 2025-04-03 01:03
Severity ?
Summary
SpamAssassin 2.5x, and 2.6x before 2.64, allows remote attackers to cause a denial of service via certain malformed messages.
References
cve@mitre.orghttp://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=129337
cve@mitre.orghttp://marc.info/?l=spamassassin-announce&m=109168121628767&w=2
cve@mitre.orghttp://security.gentoo.org/glsa/glsa-200408-06.xml
cve@mitre.orghttp://www.mandriva.com/security/advisories?name=MDKSA-2004:084
cve@mitre.orghttp://www.securityfocus.com/bid/10957Patch, Vendor Advisory
cve@mitre.orghttps://bugzilla.fedora.us/show_bug.cgi?id=2268
cve@mitre.orghttps://exchange.xforce.ibmcloud.com/vulnerabilities/16938
cve@mitre.orghttps://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10413
af854a3a-2127-422b-91ae-364da2661108http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=129337
af854a3a-2127-422b-91ae-364da2661108http://marc.info/?l=spamassassin-announce&m=109168121628767&w=2
af854a3a-2127-422b-91ae-364da2661108http://security.gentoo.org/glsa/glsa-200408-06.xml
af854a3a-2127-422b-91ae-364da2661108http://www.mandriva.com/security/advisories?name=MDKSA-2004:084
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/10957Patch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://bugzilla.fedora.us/show_bug.cgi?id=2268
af854a3a-2127-422b-91ae-364da2661108https://exchange.xforce.ibmcloud.com/vulnerabilities/16938
af854a3a-2127-422b-91ae-364da2661108https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10413
Impacted products
Vendor Product Version
spamassassin spamassassin 2.40
spamassassin spamassassin 2.41
spamassassin spamassassin 2.42
spamassassin spamassassin 2.43
spamassassin spamassassin 2.44
spamassassin spamassassin 2.50
spamassassin spamassassin 2.55
spamassassin spamassassin 2.60
spamassassin spamassassin 2.63
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:spamassassin:spamassassin:2.40:*:*:*:*:*:*:*",
              "matchCriteriaId": "2353EB59-ECCA-490F-BFCC-87D83C7913B1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:spamassassin:spamassassin:2.41:*:*:*:*:*:*:*",
              "matchCriteriaId": "5728466F-B90F-4CE8-AB48-E858C81EB592",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:spamassassin:spamassassin:2.42:*:*:*:*:*:*:*",
              "matchCriteriaId": "2DEA0682-7583-447C-A2CC-D9FE7BE5B28E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:spamassassin:spamassassin:2.43:*:*:*:*:*:*:*",
              "matchCriteriaId": "7B72B92D-9C69-4A1F-A9D3-A0ECFAD6A985",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:spamassassin:spamassassin:2.44:*:*:*:*:*:*:*",
              "matchCriteriaId": "18FD98E8-3016-4A3A-91EE-0AA443B7535D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:spamassassin:spamassassin:2.50:*:*:*:*:*:*:*",
              "matchCriteriaId": "6E50EDE0-D7C1-4C7F-B51B-F5B7976E1C67",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:spamassassin:spamassassin:2.55:*:*:*:*:*:*:*",
              "matchCriteriaId": "7BA368C7-6CB2-4BEE-A0C2-CA221F485020",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:spamassassin:spamassassin:2.60:*:*:*:*:*:*:*",
              "matchCriteriaId": "D08D6CC0-3C3B-47B0-A684-8CD08BAEAEE0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:spamassassin:spamassassin:2.63:*:*:*:*:*:*:*",
              "matchCriteriaId": "EA961C0A-3399-40F1-B3D3-E89D81617BA2",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "SpamAssassin 2.5x, and 2.6x before 2.64, allows remote attackers to cause a denial of service via certain malformed messages."
    },
    {
      "lang": "es",
      "value": "SpamAssasin 2.5x y 2.6x anteriores a 2.64 permiten a atacantes remotos causar una denegaci\u00f3n de servicio mediante ciertos mensajes malformados."
    }
  ],
  "id": "CVE-2004-0796",
  "lastModified": "2025-04-03T01:03:51.193",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 5.0,
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 10.0,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ]
  },
  "published": "2004-10-20T04:00:00.000",
  "references": [
    {
      "source": "cve@mitre.org",
      "url": "http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=129337"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://marc.info/?l=spamassassin-announce\u0026m=109168121628767\u0026w=2"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://security.gentoo.org/glsa/glsa-200408-06.xml"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.mandriva.com/security/advisories?name=MDKSA-2004:084"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "http://www.securityfocus.com/bid/10957"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://bugzilla.fedora.us/show_bug.cgi?id=2268"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/16938"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10413"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=129337"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://marc.info/?l=spamassassin-announce\u0026m=109168121628767\u0026w=2"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://security.gentoo.org/glsa/glsa-200408-06.xml"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.mandriva.com/security/advisories?name=MDKSA-2004:084"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "http://www.securityfocus.com/bid/10957"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://bugzilla.fedora.us/show_bug.cgi?id=2268"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/16938"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10413"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

FKIE_CVE-2003-1557

Vulnerability from fkie_nvd - Published: 2003-12-31 05:00 - Updated: 2025-04-03 01:03
Severity ?
Summary
Off-by-one buffer overflow in spamc of SpamAssassin 2.40 through 2.43, when using BSMTP mode ("-B"), allows remote attackers to execute arbitrary code via email containing headers with leading "." characters.
References
cve@mitre.orghttp://marc.info/?l=bugtraq&m=104342896818777&w=2
cve@mitre.orghttp://secunia.com/advisories/7983Vendor Advisory
cve@mitre.orghttp://www.securityfocus.com/archive/1/309912/30/26090/threaded
cve@mitre.orghttp://www.securityfocus.com/archive/1/310212/30/26030/threaded
cve@mitre.orghttp://www.securityfocus.com/bid/6679Patch
cve@mitre.orghttps://exchange.xforce.ibmcloud.com/vulnerabilities/11154
af854a3a-2127-422b-91ae-364da2661108http://marc.info/?l=bugtraq&m=104342896818777&w=2
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/7983Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/archive/1/309912/30/26090/threaded
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/archive/1/310212/30/26030/threaded
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/6679Patch
af854a3a-2127-422b-91ae-364da2661108https://exchange.xforce.ibmcloud.com/vulnerabilities/11154
Impacted products
Vendor Product Version
spamassassin spamassassin 2.40
spamassassin spamassassin 2.41
spamassassin spamassassin 2.42
spamassassin spamassassin 2.43
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:spamassassin:spamassassin:2.40:*:*:*:*:*:*:*",
              "matchCriteriaId": "2353EB59-ECCA-490F-BFCC-87D83C7913B1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:spamassassin:spamassassin:2.41:*:*:*:*:*:*:*",
              "matchCriteriaId": "5728466F-B90F-4CE8-AB48-E858C81EB592",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:spamassassin:spamassassin:2.42:*:*:*:*:*:*:*",
              "matchCriteriaId": "2DEA0682-7583-447C-A2CC-D9FE7BE5B28E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:spamassassin:spamassassin:2.43:*:*:*:*:*:*:*",
              "matchCriteriaId": "7B72B92D-9C69-4A1F-A9D3-A0ECFAD6A985",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Off-by-one buffer overflow in spamc of SpamAssassin 2.40 through 2.43, when using BSMTP mode (\"-B\"), allows remote attackers to execute arbitrary code via email containing headers with leading \".\" characters."
    }
  ],
  "id": "CVE-2003-1557",
  "lastModified": "2025-04-03T01:03:51.193",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "HIGH",
        "cvssData": {
          "accessComplexity": "HIGH",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "COMPLETE",
          "baseScore": 7.6,
          "confidentialityImpact": "COMPLETE",
          "integrityImpact": "COMPLETE",
          "vectorString": "AV:N/AC:H/Au:N/C:C/I:C/A:C",
          "version": "2.0"
        },
        "exploitabilityScore": 4.9,
        "impactScore": 10.0,
        "obtainAllPrivilege": true,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ]
  },
  "published": "2003-12-31T05:00:00.000",
  "references": [
    {
      "source": "cve@mitre.org",
      "url": "http://marc.info/?l=bugtraq\u0026m=104342896818777\u0026w=2"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/7983"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securityfocus.com/archive/1/309912/30/26090/threaded"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securityfocus.com/archive/1/310212/30/26030/threaded"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Patch"
      ],
      "url": "http://www.securityfocus.com/bid/6679"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/11154"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://marc.info/?l=bugtraq\u0026m=104342896818777\u0026w=2"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/7983"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/archive/1/309912/30/26090/threaded"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/archive/1/310212/30/26030/threaded"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "http://www.securityfocus.com/bid/6679"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/11154"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vendorComments": [
    {
      "comment": "Not vulnerable. This issue did not affect the versions of SpamAssassin as shipped with Red Hat Enterprise Linux 3, 4, or 5.",
      "lastModified": "2008-04-04T00:00:00",
      "organization": "Red Hat"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-119"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}