CVE-2005-4591

2006-01-0919:00:00

[email protected]

web.nvd.nist.gov

bogofilter

buffer overflow

denial of service

remote attackers

arbitrary code

unicode databases.

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

8.2 High

AI Score

Confidence

High

0.106 Low

EPSS

Percentile

95.1%

JSON

Heap-based buffer overflow in bogofilter 0.96.2, 0.95.2, 0.94.14, 0.94.12, and other versions from 0.93.5 to 0.96.2, when using Unicode databases, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via “invalid input sequences” that lead to heap corruption when bogofilter or bogolexer converts character sets.

Affected configurations

NVD

Node

bogofilteremail_filterMatch0.93.5

bogofilteremail_filterMatch0.94.12

bogofilteremail_filterMatch0.94.14

bogofilteremail_filterMatch0.95.2

bogofilteremail_filterMatch0.96.2

CPENameOperatorVersion
bogofilter:email_filterbogofilter email filtereq0.93.5
bogofilter:email_filterbogofilter email filtereq0.94.12
bogofilter:email_filterbogofilter email filtereq0.94.14
bogofilter:email_filterbogofilter email filtereq0.95.2
bogofilter:email_filterbogofilter email filtereq0.96.2

CPE	Name	Operator	Version
bogofilter:email_filter	bogofilter email filter	eq	0.93.5
bogofilter:email_filter	bogofilter email filter	eq	0.94.12
bogofilter:email_filter	bogofilter email filter	eq	0.94.14
bogofilter:email_filter	bogofilter email filter	eq	0.95.2
bogofilter:email_filter	bogofilter email filter	eq	0.96.2