Qmail SMTP Bash Environment Variable Injection (Shellshock) Exploit

This Metasploit module exploits a shellshock vulnerability on Qmail, a public domain MTA written in C that runs on Unix systems. Due to the lack of validation on the MAIL FROM field, it is possible to execute shell code on a system with a vulnerable BASH Shellshock. This flaw works on the latest...

Mozilla: Buffer overflow when drawing and validating elements with ANGLE (MFSA 2017-22)

A buffer overflow occurs when drawing and validating elements with the ANGLE graphics library, used for WebGL content. This is due to an incorrect value being passed within the library during checks and results in a potentially exploitable crash. This vulnerability affects Firefox 56, Firefox ESR...

Apple macOS High Sierra and iOS Mail Drafts Email Interception Vulnerability

Apple macOS High Sierra and iOS are both products of Apple Inc. Apple macOS High Sierra is a dedicated operating system for Mac computers. iOS is an operating system for mobile devices. Mail Drafts is one of the email drafts components. A security vulnerability exists in the Mail Drafts component...

Apple macOS High Sierra Mail Information Disclosure Vulnerability

Apple macOS High Sierra is a specialized operating system developed by Apple for Mac computers.Mail component is one of the email components. A security vulnerability exists in the Mail component of Apple macOS High Sierra versions prior to 10.13, which stems from the program failing to disable t...

Cross-Site Scripting Vulnerability in ExtMail Mail System

ExtMail is a mail system launched by Guangzhou Colliers Network Technology Co. A cross-site scripting vulnerability exists in the ExtMail email system. The attacker constructs XSS statements to perform pop-up box operations and obtain user cookies and other information...

GLSA-201709-20 : Postfix: Privilege escalation

The remote host is affected by the vulnerability described in GLSA-201709-20 Postfix: Privilege escalation By default, Berkeley DB reads a DBCONFIG configuration file from the current working directory. This is an undocumented behavior. Impact : A local attacker, by using a specially crafted...

Security fix for the ALT Linux 9 package clamav version 0.99.2-alt3

Sept. 25, 2017 Anton V. Boyarshinov 0.99.2-alt3 - Fixes: + CVE-2017-6418 remote attackers can cause a denial of service out-of-bounds read via a crafted e-mail message + CVE-2017-6420 remote attackers can cause a denial of service use-after-free via a crafted PE file with WWPack compression...

Security fix for the ALT Linux 10 package clamav version 0.99.2-alt3

Sept. 25, 2017 Anton V. Boyarshinov 0.99.2-alt3 - Fixes: + CVE-2017-6418 remote attackers can cause a denial of service out-of-bounds read via a crafted e-mail message + CVE-2017-6420 remote attackers can cause a denial of service use-after-free via a crafted PE file with WWPack compression...

Security fix for the ALT Linux 8 package clamav version 0.99.2-alt3

Sept. 25, 2017 Anton V. Boyarshinov 0.99.2-alt3 - Fixes: + CVE-2017-6418 remote attackers can cause a denial of service out-of-bounds read via a crafted e-mail message + CVE-2017-6420 remote attackers can cause a denial of service use-after-free via a crafted PE file with WWPack compression...

Postfix: Privilege escalation

Background Postfix is a mail server and an alternative to the widely-used Sendmail program. Description By default, Berkeley DB reads a DBCONFIG configuration file from the current working directory. This is an undocumented behavior. Impact A local attacker, by using a specially crafted DGCONFIG...

Debian DLA-1101-1 : emacs23 security update

Charles A. Roelli discovered that Emacs is vulnerable to arbitrary code execution when rendering text/enriched MIME data e.g. when using Emacs-based mail clients. For Debian 7 'Wheezy', these problems have been fixed in version 23.4+1-4+deb7u1. We recommend that you upgrade your emacs23 packages...

Apple iOS Mail MessageUI Memory Corruption Vulnerability

Apple iOS is an operating system developed by Apple for mobile devices.Mail MessageUI component is one of the mail and SMS components. A memory corruption vulnerability exists in the Mail MessageUI component in Apple iOS versions prior to 11. A remote attacker can exploit this vulnerability to...

[SECURITY] Fedora 26 Update: emacs-25.3-3.fc26

Emacs is a powerful, customizable, self-documenting, modeless text editor. Emacs contains special code editing features, a scripting language elisp, and the capability to read mail, news, and more without leaving the editor. This package provides an emacs binary with support for X windows...

Debian DSA-3975-1 : emacs25 - security update

Charles A. Roelli discovered that Emacs is vulnerable to arbitrary code execution when rendering text/enriched MIME data e.g. when using Emacs-based mail clients. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Debian...

Malicious Embedded Executable Downloader

Many campaigns are known to use mail attachments containing double zipped files. A remote attacker could convince users to manually trigger their execution. This would allow the malicious code to run and infect the target system...

Android Secure Mail Error "THE VPN SERVICE HAS FAILED TO CONNECT"

Secure Mail users receive an error : The VPN service has failed to connect. In the Secure mail logs we find : "2017-03-21T15:30:42.260+0800","MDX-ErrorCodes","WARNING 3","ErrorCodes = 507 507 = Vpn "2017-03-21T15:30:43.946+0800","MDX-ErrorCodes","WARNING 3","ErrorCodes = 602 602 = VpnFailedOption...

[SECURITY] Fedora 26 Update: mimedefang-2.81-1.fc26

MIMEDefang is an e-mail filter program which works with Sendmail 8.12 and later. It filters all e-mail messages sent via SMTP. MIMEDefang splits multi-part MIME messages into their components and potentially deletes or modifies the various parts. It then reassembles the parts back into an e-mail...

[SECURITY] [DSA 3970-1] emacs24 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3970-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff September 12, 2017 https://www.debian.org/security/faq -...

Cyrus IMAP Denial of Service Vulnerability

Cyrus IMAP is a free, open source Unix and Linux-based operating system for supporting IMAP Interactive Mail Access Protocol protocol mail server . A security vulnerability exists in the 'mboxlistdofind' function in the imap/mboxlist.c file in Cyrus IMAP versions prior to 3.0.4. A remote attacker...

Debian: Security Advisory (DSA-3970-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...