CVE-2020-8794
Description
OpenSMTPD before 6.6.4 allows remote code execution because of an out-of-bounds read in mta_io in mta_session.c for multi-line replies. Although this vulnerability affects the client side of OpenSMTPD, it is possible to attack a server because the server code launches the client code during bounce handling.
Risk Information
Base Score
9.8
MODERATE
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score
Exploitation Probability
88.136
Associated Vulnerability
| Vulnerability | OS Platform |
|---|---|
| opensmtpd security update(DSA-4634-1) opensmtpd_6.0.2p1-2+deb9u3_i386.deb | Linux |
| opensmtpd security update(DSA-4634-1) opensmtpd_6.0.2p1-2+deb9u3_amd64.deb | Linux |
| opensmtpd security update(DSA-4634-1) opensmtpd_6.0.3p1-5+deb10u4_i386.deb | Linux |
| opensmtpd security update(DSA-4634-1) opensmtpd_6.0.3p1-5+deb10u4_amd64.deb | Linux |
| secure, reliable, lean, and easy-to configure SMTP server (USN-4294-1) opensmtpd_6.0.3p1-1ubuntu0.2_i386.deb | Linux |
| secure, reliable, lean, and easy-to configure SMTP server (USN-4294-1) opensmtpd_6.0.3p1-1ubuntu0.2_amd64.deb | Linux |
Patch Details
No records foundReferences
https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234