Date: Thu, 4 Dec 2014 08:57:49 +0100 From: Santiago Vila <sanvila@...x.es> To: "Joshua J. Drake" <oss-sec-pmgetbl@...p.org> Cc: oss-security@...ts.openwall.com, Tero Marttila <terom@...me.fi> Subject: Re: CVE request: procmail heap overflow in getlline() On Wed, Dec 03, 2014 at 05:30:57PM -0600, Joshua J. Drake wrote: > Is it possible to trigger this issue with untrusted input or only > trusted input from procmailrc? This is an issue with the handling of .procmailrc file, which contains the filter rules for procmail. An external attacker is not supposed to provide the .procmailrc file at /home/user, only the email to be filtered, so, IMHO, this is a bug but maybe not a security bug. Thanks.
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.