CVE-2024-25768

OpenDMARC 1.4.2 contains a null pointer dereference in opendmarc_policy.c, exposed as CVE-2024-25768. Reported across multiple advisories (Mageia MGASA-2024-0370; Fedora advisories FEDORA-2024-513cf04db3 and FEDORA-2024-dede8e91b1; Fedora 41/40 notes). CVSSv3.1: 7.5 (High) with network attack vec...

CVE-2019-20790

CVE-2019-20790 affects OpenDMARC prior to 1.4.1, and OpenDMARC 1.3.2 and 1.4.x when used with pypolicyd-spf 2.0.2, enabling attacks that bypass SPF and DMARC authentication when HELO is inconsistent with MAIL FROM. Connected sources confirm this vulnerability, its impact is authentication bypass ...

CVE-2020-12460

OpenDMARC (affected: 1.3.2 and 1.4.x up to 1.4.0-Beta1) is vulnerable to an improper null termination in opendmarc_xml_parse, causing a one-byte heap overflow and remote memory corruption when parsing crafted DMARC aggregate reports. Affected components/file: opendmarc_xml_parse in OpenDMARC. Roo...

CVE-2021-34555

CVE-2021-34555 affects OpenDMARC 1.4.1 and 1.4.1.1. The advisory describes a vulnerability where processing a multi-value From header field can dereference a NULL pointer, enabling a remote attacker to cause a denial of service (application crash). The issue is confirmed across multiple sources (...

CVE-2020-12272

OpenDMARC, versions up to 1.3.2 and 1.4.x, is affected by CVE-2020-12272. The flaw arises from incorrect parsing/interpretation of SPF/DKIM authentication results, enabling attacks that inject authentication results to provide false information about the domain that originated an email. This can ...

CVE-2019-16378

CVE-2019-16378 affects OpenDMARC 1.3.2 and 1.4.x up to 1.4.0-Beta1, introducing a signature-bypass vulnerability with multiple From: addresses that could affect how domains are treated as origin. The issue is documented in multiple feeds (e.g., Fedora, Ubuntu USN-4567-1, FreeBSD VuXML) and is spe...