Re: Remotely triggerable buffer overflow in OpenSMTPD
"Jason A. Donenfeld" <[email protected]> Mon, 5 Oct 2015 10:50:20 +0200
| Newsgroups | gmane.comp.security.oss.general,gmane.mail.opensmtpd.general,gmane.linux.gentoo.security |
|---|---|
| Message-ID | <CAHmME9rmsM+FKstBTcEPCLF4Y8_yhrdhpmj65PbnwFOu7RPCRg@mail.gmail.com> |
Hi folks, On Mon, Oct 5, 2015 at 12:38 AM, Jason A. Donenfeld <[email protected]> wrote: > impact etc. There's a remotely triggerable buffer overflow in > OpenBSD's OpenSMTPD -- the latest version, 5.7.2 -- reachable by > sending messages with huge header lines. Fixed downstream in Gentoo with mail-mta/opensmtpd-5.7.2_p1-r1: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=3f8e2fe24f3ff174d8515b82607e951e054f68f6 Users are encouraged to update immediately. It's worth noting that this vulnerability was being triggered "in the wild" - hence the rushed disclosure etc. Regards, Jason -- Jason A. Donenfeld Gentoo Linux Security & Infrastructure [email protected] www.zx2c4.com zx2c4.com/keys/A28BEDE08F1744E16037514806C4536755758000.asc