A vulnerability in SpamAssassin might allow remote attackers to execute arbitrary commands.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| mail-filter/spamassassin | * | < 3.4.5 | >= 3.4.5 |
SpamAssassin is an extensible email filter used to identify junk email.
It was discovered that SpamAssassin incorrectly handled certain CF files.
A remote attacker could entice a user or automated system to process a specially crafted CF file using SpamAssassin, possibly resulting in execution of arbitrary commands with the privileges of the process or a Denial of Service condition.
There is no known workaround at this time.
All SpamAssassin users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=mail-filter/spamassassin-3.4.5"
Multiple vulnerabilities have been found in SpamAssassin, the worst of which may lead to remote code execution.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| mail-filter/spamassassin | * | < 3.4.2-r2 | >= 3.4.2-r2 |
SpamAssassin is an extensible email filter used to identify junk email.
Multiple vulnerabilities have been discovered in SpamAssassin. Please review the referenced CVE identifiers for details.
A remote attacker could execute arbitrary code, escalate privileges, or cause a Denial of Service condition.
There is no known workaround at this time.
All SpamAssassin users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=mail-filter/spamassassin-3.4.2-r2"
SpamAssassin is vulnerable to a Denial of Service attack.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| mail-filter/spamassassin | * | < 3.1.8 | >= 3.1.8 |
SpamAssassin is an extensible email filter used to identify junk email.
SpamAssassin does not correctly handle very long URIs when scanning emails.
An attacker could cause SpamAssassin to consume large amounts of CPU and memory resources by sending one or more emails containing very long URIs.
There is no known workaround at this time.
All SpamAssassin users should upgrade to the latest version.
# emerge --sync # emerge --ask --oneshot --verbose ">=mail-filter/spamassassin-3.1.8"
SpamAssassin, when running with certain options, could allow local or even remote attackers to execute arbitrary commands, possibly as the root user.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| mail-filter/spamassassin | * | < 3.1.3 | >= 3.1.3 |
SpamAssassin is an extensible email filter used to identify junk email. spamd is the daemonized version of SpamAssassin.
When spamd is run with both the "--vpopmail" (-v) and "--paranoid" (-P) options, it is vulnerable to an unspecified issue.
With certain configuration options, a local or even remote attacker could execute arbitrary code with the rights of the user running spamd, which is root by default, by sending a crafted message to the spamd daemon. Furthermore, the attack can be remotely performed if the "--allowed-ips" (-A) option is present and specifies non-local adresses. Note that Gentoo Linux is not vulnerable in the default configuration.
Don't use both the "--paranoid" (-P) and the "--vpopmail" (-v) options.
All SpamAssassin users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=mail-filter/spamassassin-3.1.3"
SpamAssassin and Vipul's Razor are vulnerable to a Denial of Service attack when handling certain malformed messages.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| mail-filter/razor | * | < 2.74 | >= 2.74 |
| mail-filter/spamassassin | * | < 3.0.4 | >= 3.0.4, < 3.0.1 |
SpamAssassin is an extensible email filter which is used to identify junk email. Vipul's Razor is a client for a distributed, collaborative spam detection and filtering network.
SpamAssassin and Vipul's Razor contain a Denial of Service vulnerability when handling special misformatted long message headers.
By sending a specially crafted message an attacker could cause a Denial of Service attack against the SpamAssassin/Vipul's Razor server.
There is no known workaround at this time.
All SpamAssassin users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=mail-filter/spamassassin-3.0.4"
All Vipul's Razor users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=mail-filter/razor-2.74"
SpamAssassin is vulnerable to a Denial of Service attack when handling certain malformed messages.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| mail-filter/spamassassin | * | <= 2.63-r1 | >= 2.64 |
SpamAssassin is an extensible email filter which is used to identify spam.
SpamAssassin contains an unspecified Denial of Service vulnerability.
By sending a specially crafted message an attacker could cause a Denial of Service attack against the SpamAssassin service.
There is no known workaround at this time. All users are encouraged to upgrade to the latest available version of SpamAssassin.
All SpamAssassin users should upgrade to the latest version:
# emerge sync # emerge -pv ">=mail-filter/spamassassin-2.64" # emerge ">=mail-filter/spamassassin-2.64"