Heap-based Buffer Overflow in procmail
Summary
DLA-1173-1: procmail - security update. Affects procmail versions < 3.22-20+deb7u2. Fixed in 3.22-20+deb7u2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Procmail is a tool used for sorting incoming mail into various directories and filtering out spam messages. It is commonly used in email systems to automate the handling of incoming messages. The package is part of the Debian 7 Wheezy ecosystem.
Vulnerability Detail
A heap-based buffer overflow vulnerability was discovered in procmail. This type of vulnerability occurs when a program writes more data to a buffer than it can hold, resulting in the overflow of adjacent memory. An attacker could exploit this vulnerability by sending a specially crafted email to a system running procmail, potentially leading to remote code execution or a denial of service.
How To Fix
Minimum fixed version
3.22-20+deb7u2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade procmailTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability.
Conclusion
A heap-based buffer overflow vulnerability has been discovered in procmail. To mitigate this issue, it is recommended to upgrade the procmail package to the latest version. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for procmail →
FAQ
Procmail is a tool used for sorting incoming mail into various directories and filtering out spam messages.
A heap-based buffer overflow occurs when a program writes more data to a buffer than it can hold, resulting in the overflow of adjacent memory.
This vulnerability could allow an attacker to execute arbitrary code or cause a denial of service on a system running procmail.
To fix this vulnerability, upgrade the procmail package to version 3.22-20+deb7u2 or later.
No, there is no known workaround for this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for procmail.
