| Package | Affected versions | Patched versions |
|---|---|---|
| hpux | ≤ b.11.31 | |
| sendmail | = 8.10= 8.10.0= 8.10.1= 8.10.2= 8.11.0= 8.11.1= 8.11.2= 8.11.3= 8.11.4= 8.11.5= 8.11.6= 8.11.7= 8.12.0= 8.12.1= 8.12.10= 8.12.11= 8.12.2= 8.12.3= 8.12.4= 8.12.5= 8.12.6= 8.12.7= 8.12.8= 8.12.9= 8.13.0= 8.13.1= 8.13.2= 8.13.3= 8.13.4= 8.13.5= 8.13.6= 8.13.7= 8.13.8= 8.14.0= 8.14.1= 8.14.2= 8.14.3= 8.14.4= 8.14.5= 8.14.6= 8.14.7= 8.6.7= 8.7.10= 8.7.6= 8.7.7= 8.7.8= 8.7.9= 8.8.8= 8.9.0= 8.9.1= 8.9.2= 8.9.3≤ 8.14.8 |
The sm_close_on_exec function in conf.c in sendmail before 8.14.9 has arguments in the wrong order, and consequently skips setting expected FD_CLOEXEC flags, which allows local users to access unintended high-numbered file descriptors via a custom mail-delivery program.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free