Lucene search
Gentoo FoundationGLSA-201412-32HistoryDec 22, 2014 - 12:00 a.m.
sendmail: Information disclosure
2014-12-2200:00:00
Gentoo Foundation
security.gentoo.org
19
1.9 Low
CVSS2
Access Vector
Access Complexity
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:L/AC:M/Au:N/C:P/I:N/A:N
0.0004 Low
EPSS
Percentile
10.0%
Background
sendmail is a widely-used Mail Transport Agent (MTA).
Description
The sm_close_on_exec function in conf.c has arguments in the wrong order.
Impact
A local attacker could get access to unintended high-numbered file descriptors via a specially crafted program.
Workaround
There is no known workaround at this time.
Resolution
All sendmail users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=mail-mta/sendmail-8.14.9"
| OS | Version | Architecture | Package | Version | Filename |
|---|---|---|---|---|---|
| Gentoo | any | all | mail-mta/sendmail | < 8.14.9 | UNKNOWN |
Related
prion
prion
Code injection
2014-06-04 11:19:00
nessus
nessus
GLSA-201412-32 : sendmail: Information disclosure
2014-12-23 00:00:00
AIX 7.1 TL 5 : sendmail (IJ03121)
2018-04-10 00:00:00
Sendmail < 8.14.9 close-on-exec SMTP Connection Manipulation
2014-06-03 00:00:00
aix
aix
openvas
openvas
Huawei EulerOS: Security Advisory for sendmail (EulerOS-SA-2019-2661)
2020-01-23 00:00:00
Huawei EulerOS: Security Advisory for sendmail (EulerOS-SA-2019-2440)
2020-01-23 00:00:00
Gentoo Security Advisory GLSA 201412-32
2015-09-29 00:00:00
fedora
fedora
[SECURITY] Fedora 19 Update: sendmail-8.14.7-2.fc19
2014-06-19 23:00:43
[SECURITY] Fedora 20 Update: sendmail-8.14.8-2.fc20
2014-06-13 05:31:53
cve
cve
CVE-2014-3956
2014-06-04 11:19:13
nvd
nvd
CVE-2014-3956
2014-06-04 11:19:13
ibm
ibm
Security Bulletin: Vulnerability in sendmail impacts AIX (CVE-2014-3956)
2021-10-26 19:42:53
securityvulns
securityvulns
sendmail file descriptor leakage
2014-06-04 00:00:00
rosalinux
rosalinux
Advisory ROSA-SA-2021-1969
2021-07-02 18:07:53
slackware
slackware
[slackware-security] sendmail
2014-06-06 05:27:31
mageia
mageia
Updated sendmail packages fix CVE-2014-3956
2014-06-20 23:41:07
debiancve
debiancve
CVE-2014-3956
2014-06-04 11:19:13
cvelist
cvelist
CVE-2014-3956
2014-06-04 10:00:00
ubuntucve
ubuntucve
CVE-2014-3956
2014-06-04 00:00:00
1.9 Low
CVSS2
Access Vector
Access Complexity
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:L/AC:M/Au:N/C:P/I:N/A:N
0.0004 Low
EPSS
Percentile
10.0%
Related for GLSA-201412-32