1. CVE-Search
  2. CVE-2021-33912
ID CVE-2021-33912
Summary libspf2 before 1.2.11 has a four-byte heap-based buffer overflow that might allow remote attackers to execute arbitrary code (via an unauthenticated e-mail message from anywhere on the Internet) with a crafted SPF DNS record, because of incorrect sprintf usage in SPF_record_expand_data in spf_expand.c. The vulnerable code may be part of the supply chain of a site's e-mail infrastructure (e.g., with additional configuration, Exim can use libspf2; the Postfix web site links to unofficial patches for use of libspf2 with Postfix; older versions of spfquery relied on libspf2) but most often is not.
References
Vulnerable Configurations
  • cpe:2.3:a:libspf2_project:libspf2:-:*:*:*:*:*:*:*
    cpe:2.3:a:libspf2_project:libspf2:-:*:*:*:*:*:*:*
  • cpe:2.3:a:libspf2_project:libspf2:0.4.0:*:*:*:*:*:*:*
    cpe:2.3:a:libspf2_project:libspf2:0.4.0:*:*:*:*:*:*:*
  • cpe:2.3:a:libspf2_project:libspf2:1.0.2:*:*:*:*:*:*:*
    cpe:2.3:a:libspf2_project:libspf2:1.0.2:*:*:*:*:*:*:*
  • cpe:2.3:a:libspf2_project:libspf2:1.0.3:*:*:*:*:*:*:*
    cpe:2.3:a:libspf2_project:libspf2:1.0.3:*:*:*:*:*:*:*
  • cpe:2.3:a:libspf2_project:libspf2:1.0.4:*:*:*:*:*:*:*
    cpe:2.3:a:libspf2_project:libspf2:1.0.4:*:*:*:*:*:*:*
  • cpe:2.3:a:libspf2_project:libspf2:1.2.1:*:*:*:*:*:*:*
    cpe:2.3:a:libspf2_project:libspf2:1.2.1:*:*:*:*:*:*:*
  • cpe:2.3:a:libspf2_project:libspf2:1.2.2:*:*:*:*:*:*:*
    cpe:2.3:a:libspf2_project:libspf2:1.2.2:*:*:*:*:*:*:*
  • cpe:2.3:a:libspf2_project:libspf2:1.2.3:*:*:*:*:*:*:*
    cpe:2.3:a:libspf2_project:libspf2:1.2.3:*:*:*:*:*:*:*
  • cpe:2.3:a:libspf2_project:libspf2:1.2.4:*:*:*:*:*:*:*
    cpe:2.3:a:libspf2_project:libspf2:1.2.4:*:*:*:*:*:*:*
  • cpe:2.3:a:libspf2_project:libspf2:1.2.5:*:*:*:*:*:*:*
    cpe:2.3:a:libspf2_project:libspf2:1.2.5:*:*:*:*:*:*:*
  • cpe:2.3:a:libspf2_project:libspf2:1.2.6:*:*:*:*:*:*:*
    cpe:2.3:a:libspf2_project:libspf2:1.2.6:*:*:*:*:*:*:*
  • cpe:2.3:a:libspf2_project:libspf2:1.2.7:*:*:*:*:*:*:*
    cpe:2.3:a:libspf2_project:libspf2:1.2.7:*:*:*:*:*:*:*
  • cpe:2.3:a:libspf2_project:libspf2:1.2.8:*:*:*:*:*:*:*
    cpe:2.3:a:libspf2_project:libspf2:1.2.8:*:*:*:*:*:*:*
  • cpe:2.3:a:libspf2_project:libspf2:1.2.9:*:*:*:*:*:*:*
    cpe:2.3:a:libspf2_project:libspf2:1.2.9:*:*:*:*:*:*:*
  • cpe:2.3:a:libspf2_project:libspf2:1.2.10:*:*:*:*:*:*:*
    cpe:2.3:a:libspf2_project:libspf2:1.2.10:*:*:*:*:*:*:*
  • cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
    cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
CVSS
Base: 9.3 (as of 15-01-2024 - 17:15)
Impact:
Exploitability:
CWE CWE-787
CAPEC
Access
VectorComplexityAuthentication
NETWORK MEDIUM NONE
Impact
ConfidentialityIntegrityAvailability
COMPLETE COMPLETE COMPLETE
cvss-vector via4 AV:N/AC:M/Au:N/C:C/I:C/A:C
Last major update 15-01-2024 - 17:15
Published 19-01-2022 - 18:15
Last modified 15-01-2024 - 17:15
Back to Top