Bug 9921 - security bug in nmh
security bug in nmh
Status: CLOSED ERRATA
Product: Red Hat Linux
Classification: Retired
Component: nmh (Show other bugs)
5.2
All Linux
medium Severity medium
: ---
: ---
Assigned To: Florian La Roche
ftp://ftp.mhost.com/pub/nmh/nmh-1.0.3...
:
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2000-03-02 10:40 EST by Healfdene Goguen
Modified: 2008-05-01 11:37 EDT (History)
0 users

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2000-03-02 12:30:40 EST
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Healfdene Goguen 2000-03-02 10:40:15 EST
Here follows the text of a security bug in nmh posted on comp.mail.mh

Subject:
              nmh security update
        Date:
              28 Feb 2000 18:38:56 +0100
        From:
              Ruud de Rooij <*@spam.ruud.org>
 Organization:
              ruud.org
  Newsgroups:
              comp.mail.mh




-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Versions prior to 1.0.3 of the nmh package contained a vulnerability
where incoming mail messages with carefully designed MIME headers could
cause nmh's mhshow command to execute arbitrary shell code.

This bug has been fixed in nmh 1.0.3 and we encourage you to upgrade
immediately.  The fixed package is available at

  ftp://ftp.mhost.com/pub/nmh/nmh-1.0.3.tar.gz

The MD5sum of nmh-1.0.3.tar.gz is 02519bf8f7ff8590ecfbee9f9500ea07.

For the nmh authors,

Ruud de Rooij.
- --
ruud de rooij | ruud@ruud.org | ruud@debian.org | http://ruud.org
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.1 (GNU/Linux)
Comment: For info see http://www.gnupg.org

iD8DBQE4uq60gWpMJ0LP/ksRAohGAJ90IJAVvyF+ouPkWEFbi5bEFJrhZwCg2yoz
XhNPTGQCtLHmKGcMsEuOUCE=
=jZwy
-----END PGP SIGNATURE-----
Comment 1 Bill Nottingham 2000-03-02 12:30:59 EST
nmh wasn't shipped in 4.2. changed to nmh component and more reasonable version.
Comment 2 Pekka Savola 2000-07-14 20:09:35 EDT
This was fixed in errata released on 06-Mar-2000.

Note You need to log in before you can comment on or make changes to this bug.