bugtraq - [SECURITY] [DSA 3019-1] procmail security update

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <E1XPdnp-0002Sd-RD@master.debian.org>
Date: Thu, 04 Sep 2014 20:38:45 +0000
From: Salvatore Bonaccorso <carnil@...ian.org>
To: bugtraq@...urityfocus.com
Subject: [SECURITY] [DSA 3019-1] procmail security update

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

- -------------------------------------------------------------------------
Debian Security Advisory DSA-3019-1                   security@...ian.org
http://www.debian.org/security/                      Salvatore Bonaccorso
September 04, 2014                     http://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package        : procmail
CVE ID         : CVE-2014-3618
Debian Bug     : 704675 760443

Boris 'pi' Piwinger and Tavis Ormandy reported a heap overflow
vulnerability in procmail's formail utility when processing
specially-crafted email headers. A remote attacker could use this flaw
to cause formail to crash, resulting in a denial of service or data
loss, or possibly execute arbitrary code.

For the stable distribution (wheezy), this problem has been fixed in
version 3.22-20+deb7u1.

For the unstable distribution (sid), this problem has been fixed in
version 3.22-22.

We recommend that you upgrade your procmail packages.

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

Mailing list: debian-security-announce@...ts.debian.org
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBCgAGBQJUCM2aAAoJEAVMuPMTQ89EiXYQAI8FfgODDJjhgCMefri5EdMy
DoykHwK7Nrblc3MkXT47Xyh7Ihrh2pfouhO6V+vX/W3tG2pquXL9aCnPXTujtpvJ
NTm5xpuoOMFUaLRXpeCwLYSzBa2h1BU2dnWFuVRSd8dNsMxsrx/Y/nI7+vyeSY30
IxR6ODjjHpBdHsi+cnYhn5wWb2kxyrOLTiDx2Q/Vwyg2GY0WojDu1r8NMs/5dUmD
MnbQaRQVYMjNww1WVr/B0T/4XDz3zLOKycD3EIj4L6mMen+H7Y6QCNc+YlZ1bKNQ
J5VBL9HmoeJiZGKThXxUFkdOWW8QMGsURl1XfN2DWzXS6qRHa5b8jjeX0EY1Utsl
liD600qjcxC08c1elS4Une3nz02y6kyH+aVyAUgHSfO0gal6x5NOF/VohEQI43vV
27vnhQMCz7uoYB8ZvohtDRKu9F0P5SXXO3hJWrX5oj3+/So9jW9xZgmxj/v2Q4eX
AU8+tAHpwcEmVmzlFnr7/irbf/25zmkQQBEYDHDtwwDIoPX6YZhru7W/Xn2Ulyvi
H6YDtdfyakv5paHN6QGE3kQEKu13SpVTp47lVV6GiZsMm1kxraGQh0q8itgis5Ko
4RVZ7I8VYbMezjHCDHEcMGU4WN4FG+LF2GkrJXRoTDwDRr6YBthMie/33Bvd9MMy
cBuaUkEYz1VJNuBHJoem
=RMOq
-----END PGP SIGNATURE-----