cgiemail and cgiecho Multiple Security Vulnerabilities (CVE-2017-5613)

SEC-212 Format string injection The ability to supply arbitrary format strings to cgiemail and cgiecho allowed code execution whenever a user was able to provide a cgiemail template file. Use CVE-2017-5613. SEC-214 Open redirect The cgiemail and cgiecho binaries served as an open redirect due to...

CVE-2017-5613

The cgiemail and cgiecho CGI programs are vulnerable to a format string injection vulnerability. A local attacker with permissions to provide a cgiemail template file can supply arbitrary format strings to execute arbitrary code as the webserver user . To remediate this, the software has been upd...