CVE-2017-5613

The cgiemail and cgiecho CGI programs are vulnerable to a format string injection vulnerability. A local attacker with permissions to provide a cgiemail template file can supply arbitrary format strings to execute arbitrary code as the webserver user . To remediate this, the software has been upd...

CVE-2017-5616

CVE-2017-5616 is a reflected XSS vulnerability in the CGI programs cgiemail and cgiecho, exploitable via the addendum parameter. The issue arises from missing escaping of the addendum data, allowing attackers to inject arbitrary HTML/JavaScript into the response. Affects implementations of cgiema...

CVE-2017-5615

CVE-2017-5615 affects the cgiemail and cgiecho binaries, enabling HTTP header injection by supplying a newline in the redirect location. Public references describe an open redirect and header-injection combination across related CVEs in the same package. The Debian advisory (DLA-869-1) fixes the ...