Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Thu, 4 Dec 2014 08:57:49 +0100
From: Santiago Vila <>
To: "Joshua J. Drake" <>
Cc:, Tero Marttila <>
Subject: Re: CVE request: procmail heap overflow in getlline()

On Wed, Dec 03, 2014 at 05:30:57PM -0600, Joshua J. Drake wrote:
> Is it possible to trigger this issue with untrusted input or only
> trusted input from procmailrc?

This is an issue with the handling of .procmailrc file, which contains
the filter rules for procmail. An external attacker is not supposed to
provide the .procmailrc file at /home/user, only the email to be
filtered, so, IMHO, this is a bug but maybe not a security bug.


Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.