| Package | Affected versions | Patched versions |
|---|---|---|
| sendmail | = 2.6= 2.6.1= 2.6.2= 3.0= 3.0.1= 3.0.2= 3.0.3= 8.10= 8.10.1= 8.10.2= 8.11.0= 8.11.1= 8.11.2= 8.11.3= 8.11.4= 8.11.5= 8.11.6= 8.12= 8.12.0= 8.12.1= 8.12.2= 8.12.3= 8.12.4= 8.12.5= 8.12.6= 8.12.7= 8.12.8= 8.9.0= 8.9.1= 8.9.2= 8.9.3 | |
| sendmail switch | = 2.1= 2.1.1= 2.1.2= 2.1.3= 2.1.4= 2.1.5= 2.2= 2.2.1= 2.2.2= 2.2.3= 2.2.4= 2.2.5= 3.0= 3.0.1= 3.0.2= 3.0.3 |
The prescan() function in the address parser (parseaddr.c) in Sendmail before 8.12.9 does not properly handle certain conversions from char and int types, which can cause a length check to be disabled when Sendmail misinterprets an input value as a special "NOCHAR" control value, allowing attackers to cause a denial of service and possibly execute arbitrary code via a buffer overflow attack using messages, a different vulnerability than CVE-2002-1337.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free