A vulnerability has been discovered in Mailutils where escape sequences are processed in a context where this may lead to RCE.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-mail/mailutils | * | < 3.12-r3 | >= 3.12-r3 |
GNU Mailutils is a collection of mail-related utilities, including an IMAP4 server (imap4d) and a Mail User Agent (mail).
A vulnerability has been discovered in GNU Mailutils. Please review the CVE identifier referenced below for details.
mail(1) from mailutils would process escape sequences (like ~! shellcommand) in message bodies piped/redirected in. This creates an RCE if some part of the message body is under an attacker's control.
There is no known workaround at this time.
All Mailutils users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-mail/mailutils-3.12-r3"
A vulnerability has been found in GNU Mailutils allowing privilege escalation.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-mail/mailutils | * | < 3.8 | >= 3.8 |
The GNU Mailutils are a collection of mail-related utilities, including an IMAP4 server (imap4d).
GNU Mailutils runs maidag by default with setuid root permissions.
An attacker can use this to write to arbitrary files as root.
There is no known workaround at this time.
All GNU Mailutils users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-mail/mailutils-3.8"
The imap4d server contains a vulnerability allowing an authenticated user to execute arbitrary code with the privileges of the imap4d process.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-mail/mailutils | * | < 0.6-r2 | >= 0.6-r2 |
The GNU Mailutils are a collection of mail-related utilities, including an IMAP4 server (imap4d).
The imap4d server contains a format string bug in the handling of IMAP SEARCH requests.
An authenticated IMAP user could exploit the format string error in imap4d to execute arbitrary code as the imap4d user, which is usually root.
There are no known workarounds at this time.
All GNU Mailutils users should upgrade to the latest available version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-mail/mailutils-0.6-r2"
GNU Mailutils is vulnerable to SQL command injection attacks.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-mail/mailutils | * | < 0.6-r1 | >= 0.6-r1 |
GNU Mailutils is a collection of mail-related utilities.
When GNU Mailutils is built with the "mysql" or "postgres" USE flag, the sql_escape_string function of the authentication module fails to properly escape the "\" character, rendering it vulnerable to a SQL command injection.
A malicious remote user could exploit this vulnerability to inject SQL commands to the underlying database.
There is no known workaround at this time.
All GNU Mailutils users should upgrade to the latest available version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-mail/mailutils-0.6-r1"
The imap4d server and the mail utility from GNU Mailutils contain multiple vulnerabilities, potentially allowing a remote attacker to execute arbitrary code with root privileges.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-mail/mailutils | * | < 0.6-r1 | >= 0.6-r1 |
GNU Mailutils is a collection of mail-related utilities, including an IMAP4 server (imap4d) and a Mail User Agent (mail).
infamous41d discovered several vulnerabilities in GNU Mailutils. imap4d does not correctly implement formatted printing of command tags (CAN-2005-1523), fails to validate the range sequence of the "FETCH" command (CAN-2005-1522), and contains an integer overflow in the "fetch_io" routine (CAN-2005-1521). mail contains a buffer overflow in "header_get_field_name()" (CAN-2005-1520).
A remote attacker can exploit the format string and integer overflow in imap4d to execute arbitrary code as the imap4d user, which is usually root. By sending a specially crafted email message, a remote attacker could exploit the buffer overflow in the "mail" utility to execute arbitrary code with the rights of the user running mail. Finally, a remote attacker can also trigger a Denial of Service by sending a malicious FETCH command to an affected imap4d, causing excessive resource consumption.
There are no known workarounds at this time.
All GNU Mailutils users should upgrade to the latest available version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-mail/mailutils-0.6-r1"