Bug 228757 (CVE-2007-0884) - CVE-2007-0884: mimedefang 2.59, 2.60 buffer overflow
Summary: CVE-2007-0884: mimedefang 2.59, 2.60 buffer overflow
Keywords:
Status: CLOSED NEXTRELEASE
Alias: CVE-2007-0884
Product: Fedora
Classification: Fedora
Component: mimedefang
Version: 6
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Robert Scheck
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2007-02-14 20:38 UTC by Ville Skyttä
Modified: 2007-11-30 22:11 UTC (History)
1 user (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2007-02-15 10:11:34 UTC
Type: ---
Embargoed:

Attachments (Terms of Use)

Description Ville Skyttä 2007-02-14 20:38:38 UTC 
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-0884

"Buffer overflow in Roaring Penguin MIMEDefang 2.59 and 2.60 allows remote
attackers to cause a denial of service (application crash) and possibly execute
arbitrary code via unspecified vectors."

All FE releases are currently at 2.58 - it is unclear to me if that's affected.
 2.61 is available in any case.
Comment 1 Robert Scheck 2007-02-14 20:46:42 UTC 
"Please note that versions 2.58 and earlier do NOT have the vulnerability." 
(from http://lists.roaringpenguin.com/pipermail/mimedefang/2007-February/
032011.html) - I'll update mimedefang anyway to 2.61.
Comment 2 Robert Scheck 2007-02-15 10:11:34 UTC 
27596 (mimedefang): Build on target fedora-development-extras succeeded.
27600 (mimedefang): Build on target fedora-6-extras succeeded.
27599 (mimedefang): Build on target fedora-5-extras succeeded.

Building mimedefang for EPEL isn't possible yet as a build requirement package 
is missing - but checked in the update there, too.
Note You need to log in before you can comment on or make changes to this bug.