Bug 228757 (CVE-2007-0884)

Summary:	CVE-2007-0884: mimedefang 2.59, 2.60 buffer overflow
Product:	[Fedora] Fedora	Reporter:	Ville Skyttä <ville.skytta>
Component:	mimedefang	Assignee:	Robert Scheck <redhat-bugzilla>
Status:	CLOSED NEXTRELEASE	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	medium	Docs Contact:
Priority:	medium
Version:	6	CC:	fedora-security-list
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2007-02-15 10:11:34 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Ville Skyttä 2007-02-14 20:38:38 UTC

http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-0884

"Buffer overflow in Roaring Penguin MIMEDefang 2.59 and 2.60 allows remote
attackers to cause a denial of service (application crash) and possibly execute
arbitrary code via unspecified vectors."

All FE releases are currently at 2.58 - it is unclear to me if that's affected.
 2.61 is available in any case.

Comment 1 Robert Scheck 2007-02-14 20:46:42 UTC

"Please note that versions 2.58 and earlier do NOT have the vulnerability." 
(from http://lists.roaringpenguin.com/pipermail/mimedefang/2007-February/
032011.html) - I'll update mimedefang anyway to 2.61.

Comment 2 Robert Scheck 2007-02-15 10:11:34 UTC

27596 (mimedefang): Build on target fedora-development-extras succeeded.
27600 (mimedefang): Build on target fedora-6-extras succeeded.
27599 (mimedefang): Build on target fedora-5-extras succeeded.

Building mimedefang for EPEL isn't possible yet as a build requirement package 
is missing - but checked in the update there, too.