ArchLinux: 201711-39: procmail: arbitrary code execution
Summary
A heap-based buffer overflow flaw was found in the loadbuf function in formisc.c in the formail utility in procmail <= 3.22 because of a hardcoded realloc size. When the buffer is too small, the function tries to resize it, but only by Bsize (=128) bytes which is not necessarily enough. A remote attacker could send a specially crafted email that, when processed by formail, could cause formail to crash or, possibly, execute arbitrary code as the user running formail.
Resolution
Upgrade to 3.22-9.
# pacman -Syu "procmail>=3.22-9"
The problem has been fixed upstream but no release is available yet.
References
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=876511 https://security.archlinux.org/CVE-2017-16844
![Dist Arch](/images/distros/dist-arch.png)
Workaround
None.