CVE-2014-3618

procmail 3.22 - Heap-Based Buffer Overflow via Crafted Email Header

Title source: llm
STIX 2.1

Description

Heap-based buffer overflow in formisc.c in formail in procmail 3.22 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted email header, related to "unbalanced quotes."

References (14)

Core 14
Core References
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/61108
Third Party Advisory vendor-advisory x_refsource_debian
http://www.debian.org/security/2014/dsa-3019
Exploit mailing-list x_refsource_mlist
http://www.openwall.com/lists/oss-security/2014/09/03/8
Vendor Advisory vendor-advisory x_refsource_ubuntu
http://www.ubuntu.com/usn/USN-2340-1
Various Sources x_refsource_confirm
http://linux.oracle.com/errata/ELSA-2014-1172.html
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/61090
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/69573
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/61076
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/95688
Mailing List vendor-advisory x_refsource_apple
http://lists.apple.com/archives/security-announce/2015/Sep/msg00008.html
Vendor Advisory vendor-advisory x_refsource_redhat
http://rhn.redhat.com/errata/RHSA-2014-1172.html
Vendor Advisory x_refsource_confirm
https://support.apple.com/HT205267

Scores

EPSS 0.0853
EPSS Percentile 94.4%

Details

CWE
CWE-119
Status published
Products (4)
canonical/ubuntu_linux 10.04
canonical/ubuntu_linux 12.04
canonical/ubuntu_linux 14.04
procmail/procmail 3.22
Published Sep 08, 2014
Tracked Since Feb 18, 2026