Null pointer dereference when viewing a specially crafted email in Mutt > 1.5.2 1.5.2 1.5.2 1.5.2
An update for procmail is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ==================================================================== Red Hat Security Advisory Synopsis: Important: procmail security update Advisory ID: RHSA-2017:3269-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2017:3269 Issue date: 2017-11-28 CVE Names: CVE-2017-16844 ==================================================================== 1. Summary: An update for procmail is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux Client Optional (v. 7) - x86_64 Red Hat Enterprise Linux Server (v. 7) - ppc64, ppc64le, s390x, x86_64 Red Hat Enterprise Linux Workstation (v. 7) - x86_64 Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7) - aarch64, ppc64le 3. Description: The procmail packages contain a mail processing tool that can be used to create mail servers, mailing lists, sort incoming mail into separate folders or files, preprocess mail, start any program upon mail arrival, or automatically forward selected incoming mail. Security Fix(es): * A heap-based buffer overflow flaw was found in procmail's formail utility. A remote attacker could send a specially crafted email that, when processed by formail, could cause formail to crash or, possibly, execute arbitrary code as the user running formail. (CVE-2017-16844) 4.Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1500070 - CVE-2017-16844 procmail: Heap-based buffer overflow in loadbuf function in formisc.c 6. Package List: Red Hat Enterprise Linux Client Optional (v. 7): Source: procmail-3.22-36.el7_4.1.src.rpm x86_64: procmail-3.22-36.el7_4.1.x86_64.rpm procmail-debuginfo-3.22-36.el7_4.1.x86_64.rpm Red Hat Enterprise Linux Server (v. 7): Source: procmail-3.22-36.el7_4.1.src.rpm ppc64: procmail-3.22-36.el7_4.1.ppc64.rpm procmail-debuginfo-3.22-36.el7_4.1.ppc64.rpm ppc64le: procmail-3.22-36.el7_4.1.ppc64le.rpm procmail-debuginfo-3.22-36.el7_4.1.ppc64le.rpm s390x: procmail-3.22-36.el7_4.1.s390x.rpm procmail-debuginfo-3.22-36.el7_4.1.s390x.rpm x86_64: procmail-3.22-36.el7_4.1.x86_64.rpm procmail-debuginfo-3.22-36.el7_4.1.x86_64.rpm Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7): Source: procmail-3.22-36.el7_4.1.src.rpm aarch64: procmail-3.22-36.el7_4.1.aarch64.rpm procmail-debuginfo-3.22-36.el7_4.1.aarch64.rpm ppc64le: procmail-3.22-36.el7_4.1.ppc64le.rpm procmail-debuginfo-3.22-36.el7_4.1.ppc64le.rpm Red Hat Enterprise Linux Workstation (v. 7): Source: procmail-3.22-36.el7_4.1.src.rpm x86_64: procmail-3.22-36.el7_4.1.x86_64.rpm procmail-debuginfo-3.22-36.el7_4.1.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2017-16844 https://access.redhat.com/security/updates/classification/#important 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2017 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iD8DBQFaHd0NXlSAg2UNWIIRAkX6AJ4pLQI+dx8Fm1xHehnwfPc8DMqwTwCeJvsK PWKDWDmjXdT9z5q3RieVuGE=/ACr -----ENDPGP SIGNATURE----- -- RHSA-announce mailing list
formail could be made to crash or run programs if it processed specially crafted mail.. =========================================================================Ubuntu Security Notice USN-2340-1 September 04, 2014 procmail vulnerability ========================================================================= A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 14.04 LTS - Ubuntu 12.04 LTS - Ubuntu 10.04 LTS Summary: formail could be made to crash or run programs if it processed specially crafted mail. Software Description: - procmail: Versatile e-mail processor Details: Tavis Ormandy discovered that the formail tool incorrectly handled certain malformed mail headers. An attacker could use this flaw to cause formail to crash, resulting in a denial of service, or possibly execute arbitrary code. Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 14.04 LTS: procmail 3.22-21ubuntu0.1 Ubuntu 12.04 LTS: procmail 3.22-19ubuntu0.1 Ubuntu 10.04 LTS: procmail 3.22-18ubuntu1.1 In general, a standard system update will make all the necessary changes. References: https://ubuntu.com/security/notices/USN-2340-1 CVE-2014-3618 Package Information: https://launchpad.net/ubuntu/+source/procmail/3.22-21ubuntu0.1 https://launchpad.net/ubuntu/+source/procmail/3.22-19ubuntu0.1 https://launchpad.net/ubuntu/+source/procmail/3.22-18ubuntu1.1 . Ubuntu Security Notice USN-2341-1 pertains to a postfix flaw impacting several LTS iterations and message processing.. procmail vulnerability, Denial of Service, email processing issue. . Severity: Critical. LinuxSecurity.com Team
Get the latest Linux and open source security news straight to your inbox.