[SECURITY] Fedora Core 5 Update: spamassassin-3.1.8-1.fc5

SpamAssassin provides you with a way to reduce if not completely eliminate Unsolicited Commercial Email SPAM from your incoming email. It can be invoked by a MDA such as sendmail or postfix, or can be called from a procmail script, .forward file, etc. It uses a genetic-algorithm evolved scoring...

Ingo H3: Folder name shell command injection

Background Ingo H3 is a generic frontend for editing Sieve, procmail, maildrop and IMAP filter rules. Description Ingo H3 fails to properly escape shell metacharacters in procmail rules. Impact A remote authenticated attacker could craft a malicious rule which could lead to the execution of...

Ingo Procmail驱动Shell命令执行漏洞

Ingo是一款邮件过滤规则管理器，集成于Horde和IMP Webmail客户端。 Ingo的procmail驱动没有正确地转义文件夹名称，远程攻击者可能利用此漏洞执行任意Shell命令。 Horde Ingo 1.1.1 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： ftp://ftp.horde.org/pub/ingo/ingo-h3-1.1.2.tar.gz http://ftp.horde.org/pub/ingo/ingo-h3-1.1.2.tar.gz...

CVE-2006-5449

procmail in Ingo H3 before 1.1.2 Horde module allows remote authenticated users to execute arbitrary commands via shell metacharacters in the mailbox destination of a filter rule...

CVE-2006-5449

CVE-2006-5449 affects Ingo H3 (Horde module) and allows remote authenticated users to execute arbitrary shell commands via metacharacters in the mailbox destination of a filter rule. The issue arises from inadequate escaping in procmail rule generation. Affected software is Ingo H3 up to version ...

CVE-2006-5449: Undefined Security Weakness

procmail in Ingo H3 before 1.1.2 Horde module allows remote authenticated users to execute arbitrary commands via shell metacharacters in the mailbox destination of a filter rule...

ingo -- local arbitrary shell command execution

The Horde team reports a vulnerability within Ingo, the filter management suite. The vulnerability is caused due to inadequete escaping, possibly allowing a local user to execute arbitrary shell commands via procmail...

CVE-2002-2034

The Email Sanitizer before 1.133 for Procmail allows remote attackers to bypass the mail filter and execute arbitrary code via crafted recursive multipart MIME attachments...

CVE-2002-2034

CVE-2002-2034 affects the Email Sanitizer prior to 1.133 used with Procmail. The vulnerability allows remote attackers to bypass the mail filter and execute arbitrary code by sending crafted recursive multipart MIME attachments. Documented impact is arbitrary code execution via email processing, ...

CVE-2002-2034: Undefined Security Weakness

The Email Sanitizer before 1.133 for Procmail allows remote attackers to bypass the mail filter and execute arbitrary code via crafted recursive multipart MIME attachments...

Debian DSA-083-1 : procmail - insecure signal handling

Using older versions of procmail it was possible to make procmail crash by sending it signals. On systems where procmail is installed setuid this could be exploited to obtain unauthorized privileges. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in...

Mandrake Linux Security Advisory : procmail (MDKSA-2001:085)

In older versions of procmail, it is possible to crash procmail by sending it certain signals. If procmail is installed setuid, this could be exploited to gain unauthorized privilege. This problem is fixed in unstable version 3.20 and stable version 3.15.2. %NASLMINLEVEL 70300 C Tenable Network...

CVE-2001-0905

Race condition in signal handling of procmail 3.20 and earlier, when running setuid, allows local users to cause a denial of service or gain root privileges by sending a signal while a signal handling routine is already running...

CVE-2001-0905

The provided sources confirm CVE-2001-0905: a race condition in the signal handling of procmail versions 3.20 and earlier when running setuid. This vulnerability allows local users to cause a denial of service or gain root privileges by sending a signal while a signal handling routine is already ...

CVE-2001-0905: Undefined Security Weakness

Race condition in signal handling of procmail 3.20 and earlier, when running setuid, allows local users to cause a denial of service or gain root privileges by sending a signal while a signal handling routine is already running...

procmail heap overflow

hi, i found a heap overflow in procmail up until latest some time ago. flatline@intra:/usr/bin$ ls -la procmail -rwsr-xr-x 1 root mail 64344 Jun 3 2001 procmail flatline@intra:/usr/bin$ ./procmail perl -e 'print "A"x10240'=A procmail: Exceeded LINEBUF Segmentation fault flatline@intra:/usr/bin$ a...

procmail buffer overflow

Buffer overflow on long command line argument...

[SECURITY] [DSA 083-1] New procmail packages fix insecure signal handling

-------------------------------------------------------------------------- Debian Security Advisory DSA 083-1 [email protected] http://www.debian.org/security/ Martin Schulze October 18th, 2001 - -------------------------------------------------------------------------- Package : procmail...

CVE-2001-0905

Race condition in signal handling of procmail 3.20 and earlier, when running setuid, allows local users to cause a denial of service or gain root privileges by sending a signal while a signal handling routine is already running...

FreeBSD-SA-01:60.procmail

-----BEGIN PGP SIGNED MESSAGE----- ============================================================================= FreeBSD-SA-01:60 Security Advisory FreeBSD, Inc. Topic: Multiple vulnerabilities in procmail signal handling Category: ports Module: procmail Announced: 2001-09-24 Credits: Philip A...