csaf_redhat - rhsa-2017

rhsa-2017_3269

Vulnerability from csaf_redhat

Published

2017-11-28 22:02

Modified

2024-11-22 11:39

Summary

Red Hat Security Advisory: procmail security update

Notes

Topic

An update for procmail is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Details

The procmail packages contain a mail processing tool that can be used to create mail servers, mailing lists, sort incoming mail into separate folders or files, preprocess mail, start any program upon mail arrival, or automatically forward selected incoming mail. Security Fix(es): * A heap-based buffer overflow flaw was found in procmail's formail utility. A remote attacker could send a specially crafted email that, when processed by formail, could cause formail to crash or, possibly, execute arbitrary code as the user running formail. (CVE-2017-16844)

This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for procmail is now available for Red Hat Enterprise Linux 7.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "The procmail packages contain a mail processing tool that can be used to create mail servers, mailing lists, sort incoming mail into separate folders or files, preprocess mail, start any program upon mail arrival, or automatically forward selected incoming mail.\n\nSecurity Fix(es):\n\n* A heap-based buffer overflow flaw was found in procmail\u0027s formail utility. A remote attacker could send a specially crafted email that, when processed by formail, could cause formail to crash or, possibly, execute arbitrary code as the user running formail. (CVE-2017-16844)",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2017:3269",
        "url": "https://access.redhat.com/errata/RHSA-2017:3269"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "1500070",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1500070"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_3269.json"
      }
    ],
    "title": "Red Hat Security Advisory: procmail security update",
    "tracking": {
      "current_release_date": "2024-11-22T11:39:52+00:00",
      "generator": {
        "date": "2024-11-22T11:39:52+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.2.1"
        }
      },
      "id": "RHSA-2017:3269",
      "initial_release_date": "2017-11-28T22:02:16+00:00",
      "revision_history": [
        {
          "date": "2017-11-28T22:02:16+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2017-11-28T22:02:16+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-11-22T11:39:52+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux Client Optional (v. 7)",
                "product": {
                  "name": "Red Hat Enterprise Linux Client Optional (v. 7)",
                  "product_id": "7Client-optional-7.4.Z",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:enterprise_linux:7::client"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux Server (v. 7)",
                "product": {
                  "name": "Red Hat Enterprise Linux Server (v. 7)",
                  "product_id": "7Server-7.4.Z",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:enterprise_linux:7::server"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7)",
                "product": {
                  "name": "Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7)",
                  "product_id": "7Server-Alt-7.4.Z",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:enterprise_linux:7::server"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux Workstation (v. 7)",
                "product": {
                  "name": "Red Hat Enterprise Linux Workstation (v. 7)",
                  "product_id": "7Workstation-7.4.Z",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:enterprise_linux:7::workstation"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Enterprise Linux"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "procmail-debuginfo-0:3.22-36.el7_4.1.x86_64",
                "product": {
                  "name": "procmail-debuginfo-0:3.22-36.el7_4.1.x86_64",
                  "product_id": "procmail-debuginfo-0:3.22-36.el7_4.1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/procmail-debuginfo@3.22-36.el7_4.1?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "procmail-0:3.22-36.el7_4.1.x86_64",
                "product": {
                  "name": "procmail-0:3.22-36.el7_4.1.x86_64",
                  "product_id": "procmail-0:3.22-36.el7_4.1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/procmail@3.22-36.el7_4.1?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "procmail-0:3.22-36.el7_4.1.src",
                "product": {
                  "name": "procmail-0:3.22-36.el7_4.1.src",
                  "product_id": "procmail-0:3.22-36.el7_4.1.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/procmail@3.22-36.el7_4.1?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "procmail-debuginfo-0:3.22-36.el7_4.1.s390x",
                "product": {
                  "name": "procmail-debuginfo-0:3.22-36.el7_4.1.s390x",
                  "product_id": "procmail-debuginfo-0:3.22-36.el7_4.1.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/procmail-debuginfo@3.22-36.el7_4.1?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "procmail-0:3.22-36.el7_4.1.s390x",
                "product": {
                  "name": "procmail-0:3.22-36.el7_4.1.s390x",
                  "product_id": "procmail-0:3.22-36.el7_4.1.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/procmail@3.22-36.el7_4.1?arch=s390x"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "procmail-debuginfo-0:3.22-36.el7_4.1.ppc64",
                "product": {
                  "name": "procmail-debuginfo-0:3.22-36.el7_4.1.ppc64",
                  "product_id": "procmail-debuginfo-0:3.22-36.el7_4.1.ppc64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/procmail-debuginfo@3.22-36.el7_4.1?arch=ppc64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "procmail-0:3.22-36.el7_4.1.ppc64",
                "product": {
                  "name": "procmail-0:3.22-36.el7_4.1.ppc64",
                  "product_id": "procmail-0:3.22-36.el7_4.1.ppc64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/procmail@3.22-36.el7_4.1?arch=ppc64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "procmail-debuginfo-0:3.22-36.el7_4.1.ppc64le",
                "product": {
                  "name": "procmail-debuginfo-0:3.22-36.el7_4.1.ppc64le",
                  "product_id": "procmail-debuginfo-0:3.22-36.el7_4.1.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/procmail-debuginfo@3.22-36.el7_4.1?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "procmail-0:3.22-36.el7_4.1.ppc64le",
                "product": {
                  "name": "procmail-0:3.22-36.el7_4.1.ppc64le",
                  "product_id": "procmail-0:3.22-36.el7_4.1.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/procmail@3.22-36.el7_4.1?arch=ppc64le"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "procmail-debuginfo-0:3.22-36.el7_4.1.aarch64",
                "product": {
                  "name": "procmail-debuginfo-0:3.22-36.el7_4.1.aarch64",
                  "product_id": "procmail-debuginfo-0:3.22-36.el7_4.1.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/procmail-debuginfo@3.22-36.el7_4.1?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "procmail-0:3.22-36.el7_4.1.aarch64",
                "product": {
                  "name": "procmail-0:3.22-36.el7_4.1.aarch64",
                  "product_id": "procmail-0:3.22-36.el7_4.1.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/procmail@3.22-36.el7_4.1?arch=aarch64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "procmail-0:3.22-36.el7_4.1.aarch64 as a component of Red Hat Enterprise Linux Client Optional (v. 7)",
          "product_id": "7Client-optional-7.4.Z:procmail-0:3.22-36.el7_4.1.aarch64"
        },
        "product_reference": "procmail-0:3.22-36.el7_4.1.aarch64",
        "relates_to_product_reference": "7Client-optional-7.4.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "procmail-0:3.22-36.el7_4.1.ppc64 as a component of Red Hat Enterprise Linux Client Optional (v. 7)",
          "product_id": "7Client-optional-7.4.Z:procmail-0:3.22-36.el7_4.1.ppc64"
        },
        "product_reference": "procmail-0:3.22-36.el7_4.1.ppc64",
        "relates_to_product_reference": "7Client-optional-7.4.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "procmail-0:3.22-36.el7_4.1.ppc64le as a component of Red Hat Enterprise Linux Client Optional (v. 7)",
          "product_id": "7Client-optional-7.4.Z:procmail-0:3.22-36.el7_4.1.ppc64le"
        },
        "product_reference": "procmail-0:3.22-36.el7_4.1.ppc64le",
        "relates_to_product_reference": "7Client-optional-7.4.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "procmail-0:3.22-36.el7_4.1.s390x as a component of Red Hat Enterprise Linux Client Optional (v. 7)",
          "product_id": "7Client-optional-7.4.Z:procmail-0:3.22-36.el7_4.1.s390x"
        },
        "product_reference": "procmail-0:3.22-36.el7_4.1.s390x",
        "relates_to_product_reference": "7Client-optional-7.4.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "procmail-0:3.22-36.el7_4.1.src as a component of Red Hat Enterprise Linux Client Optional (v. 7)",
          "product_id": "7Client-optional-7.4.Z:procmail-0:3.22-36.el7_4.1.src"
        },
        "product_reference": "procmail-0:3.22-36.el7_4.1.src",
        "relates_to_product_reference": "7Client-optional-7.4.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "procmail-0:3.22-36.el7_4.1.x86_64 as a component of Red Hat Enterprise Linux Client Optional (v. 7)",
          "product_id": "7Client-optional-7.4.Z:procmail-0:3.22-36.el7_4.1.x86_64"
        },
        "product_reference": "procmail-0:3.22-36.el7_4.1.x86_64",
        "relates_to_product_reference": "7Client-optional-7.4.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "procmail-debuginfo-0:3.22-36.el7_4.1.aarch64 as a component of Red Hat Enterprise Linux Client Optional (v. 7)",
          "product_id": "7Client-optional-7.4.Z:procmail-debuginfo-0:3.22-36.el7_4.1.aarch64"
        },
        "product_reference": "procmail-debuginfo-0:3.22-36.el7_4.1.aarch64",
        "relates_to_product_reference": "7Client-optional-7.4.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "procmail-debuginfo-0:3.22-36.el7_4.1.ppc64 as a component of Red Hat Enterprise Linux Client Optional (v. 7)",
          "product_id": "7Client-optional-7.4.Z:procmail-debuginfo-0:3.22-36.el7_4.1.ppc64"
        },
        "product_reference": "procmail-debuginfo-0:3.22-36.el7_4.1.ppc64",
        "relates_to_product_reference": "7Client-optional-7.4.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "procmail-debuginfo-0:3.22-36.el7_4.1.ppc64le as a component of Red Hat Enterprise Linux Client Optional (v. 7)",
          "product_id": "7Client-optional-7.4.Z:procmail-debuginfo-0:3.22-36.el7_4.1.ppc64le"
        },
        "product_reference": "procmail-debuginfo-0:3.22-36.el7_4.1.ppc64le",
        "relates_to_product_reference": "7Client-optional-7.4.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "procmail-debuginfo-0:3.22-36.el7_4.1.s390x as a component of Red Hat Enterprise Linux Client Optional (v. 7)",
          "product_id": "7Client-optional-7.4.Z:procmail-debuginfo-0:3.22-36.el7_4.1.s390x"
        },
        "product_reference": "procmail-debuginfo-0:3.22-36.el7_4.1.s390x",
        "relates_to_product_reference": "7Client-optional-7.4.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "procmail-debuginfo-0:3.22-36.el7_4.1.x86_64 as a component of Red Hat Enterprise Linux Client Optional (v. 7)",
          "product_id": "7Client-optional-7.4.Z:procmail-debuginfo-0:3.22-36.el7_4.1.x86_64"
        },
        "product_reference": "procmail-debuginfo-0:3.22-36.el7_4.1.x86_64",
        "relates_to_product_reference": "7Client-optional-7.4.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "procmail-0:3.22-36.el7_4.1.aarch64 as a component of Red Hat Enterprise Linux Server (v. 7)",
          "product_id": "7Server-7.4.Z:procmail-0:3.22-36.el7_4.1.aarch64"
        },
        "product_reference": "procmail-0:3.22-36.el7_4.1.aarch64",
        "relates_to_product_reference": "7Server-7.4.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "procmail-0:3.22-36.el7_4.1.ppc64 as a component of Red Hat Enterprise Linux Server (v. 7)",
          "product_id": "7Server-7.4.Z:procmail-0:3.22-36.el7_4.1.ppc64"
        },
        "product_reference": "procmail-0:3.22-36.el7_4.1.ppc64",
        "relates_to_product_reference": "7Server-7.4.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "procmail-0:3.22-36.el7_4.1.ppc64le as a component of Red Hat Enterprise Linux Server (v. 7)",
          "product_id": "7Server-7.4.Z:procmail-0:3.22-36.el7_4.1.ppc64le"
        },
        "product_reference": "procmail-0:3.22-36.el7_4.1.ppc64le",
        "relates_to_product_reference": "7Server-7.4.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "procmail-0:3.22-36.el7_4.1.s390x as a component of Red Hat Enterprise Linux Server (v. 7)",
          "product_id": "7Server-7.4.Z:procmail-0:3.22-36.el7_4.1.s390x"
        },
        "product_reference": "procmail-0:3.22-36.el7_4.1.s390x",
        "relates_to_product_reference": "7Server-7.4.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "procmail-0:3.22-36.el7_4.1.src as a component of Red Hat Enterprise Linux Server (v. 7)",
          "product_id": "7Server-7.4.Z:procmail-0:3.22-36.el7_4.1.src"
        },
        "product_reference": "procmail-0:3.22-36.el7_4.1.src",
        "relates_to_product_reference": "7Server-7.4.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "procmail-0:3.22-36.el7_4.1.x86_64 as a component of Red Hat Enterprise Linux Server (v. 7)",
          "product_id": "7Server-7.4.Z:procmail-0:3.22-36.el7_4.1.x86_64"
        },
        "product_reference": "procmail-0:3.22-36.el7_4.1.x86_64",
        "relates_to_product_reference": "7Server-7.4.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "procmail-debuginfo-0:3.22-36.el7_4.1.aarch64 as a component of Red Hat Enterprise Linux Server (v. 7)",
          "product_id": "7Server-7.4.Z:procmail-debuginfo-0:3.22-36.el7_4.1.aarch64"
        },
        "product_reference": "procmail-debuginfo-0:3.22-36.el7_4.1.aarch64",
        "relates_to_product_reference": "7Server-7.4.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "procmail-debuginfo-0:3.22-36.el7_4.1.ppc64 as a component of Red Hat Enterprise Linux Server (v. 7)",
          "product_id": "7Server-7.4.Z:procmail-debuginfo-0:3.22-36.el7_4.1.ppc64"
        },
        "product_reference": "procmail-debuginfo-0:3.22-36.el7_4.1.ppc64",
        "relates_to_product_reference": "7Server-7.4.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "procmail-debuginfo-0:3.22-36.el7_4.1.ppc64le as a component of Red Hat Enterprise Linux Server (v. 7)",
          "product_id": "7Server-7.4.Z:procmail-debuginfo-0:3.22-36.el7_4.1.ppc64le"
        },
        "product_reference": "procmail-debuginfo-0:3.22-36.el7_4.1.ppc64le",
        "relates_to_product_reference": "7Server-7.4.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "procmail-debuginfo-0:3.22-36.el7_4.1.s390x as a component of Red Hat Enterprise Linux Server (v. 7)",
          "product_id": "7Server-7.4.Z:procmail-debuginfo-0:3.22-36.el7_4.1.s390x"
        },
        "product_reference": "procmail-debuginfo-0:3.22-36.el7_4.1.s390x",
        "relates_to_product_reference": "7Server-7.4.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "procmail-debuginfo-0:3.22-36.el7_4.1.x86_64 as a component of Red Hat Enterprise Linux Server (v. 7)",
          "product_id": "7Server-7.4.Z:procmail-debuginfo-0:3.22-36.el7_4.1.x86_64"
        },
        "product_reference": "procmail-debuginfo-0:3.22-36.el7_4.1.x86_64",
        "relates_to_product_reference": "7Server-7.4.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "procmail-0:3.22-36.el7_4.1.aarch64 as a component of Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7)",
          "product_id": "7Server-Alt-7.4.Z:procmail-0:3.22-36.el7_4.1.aarch64"
        },
        "product_reference": "procmail-0:3.22-36.el7_4.1.aarch64",
        "relates_to_product_reference": "7Server-Alt-7.4.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "procmail-0:3.22-36.el7_4.1.ppc64 as a component of Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7)",
          "product_id": "7Server-Alt-7.4.Z:procmail-0:3.22-36.el7_4.1.ppc64"
        },
        "product_reference": "procmail-0:3.22-36.el7_4.1.ppc64",
        "relates_to_product_reference": "7Server-Alt-7.4.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "procmail-0:3.22-36.el7_4.1.ppc64le as a component of Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7)",
          "product_id": "7Server-Alt-7.4.Z:procmail-0:3.22-36.el7_4.1.ppc64le"
        },
        "product_reference": "procmail-0:3.22-36.el7_4.1.ppc64le",
        "relates_to_product_reference": "7Server-Alt-7.4.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "procmail-0:3.22-36.el7_4.1.s390x as a component of Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7)",
          "product_id": "7Server-Alt-7.4.Z:procmail-0:3.22-36.el7_4.1.s390x"
        },
        "product_reference": "procmail-0:3.22-36.el7_4.1.s390x",
        "relates_to_product_reference": "7Server-Alt-7.4.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "procmail-0:3.22-36.el7_4.1.src as a component of Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7)",
          "product_id": "7Server-Alt-7.4.Z:procmail-0:3.22-36.el7_4.1.src"
        },
        "product_reference": "procmail-0:3.22-36.el7_4.1.src",
        "relates_to_product_reference": "7Server-Alt-7.4.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "procmail-0:3.22-36.el7_4.1.x86_64 as a component of Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7)",
          "product_id": "7Server-Alt-7.4.Z:procmail-0:3.22-36.el7_4.1.x86_64"
        },
        "product_reference": "procmail-0:3.22-36.el7_4.1.x86_64",
        "relates_to_product_reference": "7Server-Alt-7.4.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "procmail-debuginfo-0:3.22-36.el7_4.1.aarch64 as a component of Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7)",
          "product_id": "7Server-Alt-7.4.Z:procmail-debuginfo-0:3.22-36.el7_4.1.aarch64"
        },
        "product_reference": "procmail-debuginfo-0:3.22-36.el7_4.1.aarch64",
        "relates_to_product_reference": "7Server-Alt-7.4.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "procmail-debuginfo-0:3.22-36.el7_4.1.ppc64 as a component of Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7)",
          "product_id": "7Server-Alt-7.4.Z:procmail-debuginfo-0:3.22-36.el7_4.1.ppc64"
        },
        "product_reference": "procmail-debuginfo-0:3.22-36.el7_4.1.ppc64",
        "relates_to_product_reference": "7Server-Alt-7.4.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "procmail-debuginfo-0:3.22-36.el7_4.1.ppc64le as a component of Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7)",
          "product_id": "7Server-Alt-7.4.Z:procmail-debuginfo-0:3.22-36.el7_4.1.ppc64le"
        },
        "product_reference": "procmail-debuginfo-0:3.22-36.el7_4.1.ppc64le",
        "relates_to_product_reference": "7Server-Alt-7.4.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "procmail-debuginfo-0:3.22-36.el7_4.1.s390x as a component of Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7)",
          "product_id": "7Server-Alt-7.4.Z:procmail-debuginfo-0:3.22-36.el7_4.1.s390x"
        },
        "product_reference": "procmail-debuginfo-0:3.22-36.el7_4.1.s390x",
        "relates_to_product_reference": "7Server-Alt-7.4.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "procmail-debuginfo-0:3.22-36.el7_4.1.x86_64 as a component of Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7)",
          "product_id": "7Server-Alt-7.4.Z:procmail-debuginfo-0:3.22-36.el7_4.1.x86_64"
        },
        "product_reference": "procmail-debuginfo-0:3.22-36.el7_4.1.x86_64",
        "relates_to_product_reference": "7Server-Alt-7.4.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "procmail-0:3.22-36.el7_4.1.aarch64 as a component of Red Hat Enterprise Linux Workstation (v. 7)",
          "product_id": "7Workstation-7.4.Z:procmail-0:3.22-36.el7_4.1.aarch64"
        },
        "product_reference": "procmail-0:3.22-36.el7_4.1.aarch64",
        "relates_to_product_reference": "7Workstation-7.4.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "procmail-0:3.22-36.el7_4.1.ppc64 as a component of Red Hat Enterprise Linux Workstation (v. 7)",
          "product_id": "7Workstation-7.4.Z:procmail-0:3.22-36.el7_4.1.ppc64"
        },
        "product_reference": "procmail-0:3.22-36.el7_4.1.ppc64",
        "relates_to_product_reference": "7Workstation-7.4.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "procmail-0:3.22-36.el7_4.1.ppc64le as a component of Red Hat Enterprise Linux Workstation (v. 7)",
          "product_id": "7Workstation-7.4.Z:procmail-0:3.22-36.el7_4.1.ppc64le"
        },
        "product_reference": "procmail-0:3.22-36.el7_4.1.ppc64le",
        "relates_to_product_reference": "7Workstation-7.4.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "procmail-0:3.22-36.el7_4.1.s390x as a component of Red Hat Enterprise Linux Workstation (v. 7)",
          "product_id": "7Workstation-7.4.Z:procmail-0:3.22-36.el7_4.1.s390x"
        },
        "product_reference": "procmail-0:3.22-36.el7_4.1.s390x",
        "relates_to_product_reference": "7Workstation-7.4.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "procmail-0:3.22-36.el7_4.1.src as a component of Red Hat Enterprise Linux Workstation (v. 7)",
          "product_id": "7Workstation-7.4.Z:procmail-0:3.22-36.el7_4.1.src"
        },
        "product_reference": "procmail-0:3.22-36.el7_4.1.src",
        "relates_to_product_reference": "7Workstation-7.4.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "procmail-0:3.22-36.el7_4.1.x86_64 as a component of Red Hat Enterprise Linux Workstation (v. 7)",
          "product_id": "7Workstation-7.4.Z:procmail-0:3.22-36.el7_4.1.x86_64"
        },
        "product_reference": "procmail-0:3.22-36.el7_4.1.x86_64",
        "relates_to_product_reference": "7Workstation-7.4.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "procmail-debuginfo-0:3.22-36.el7_4.1.aarch64 as a component of Red Hat Enterprise Linux Workstation (v. 7)",
          "product_id": "7Workstation-7.4.Z:procmail-debuginfo-0:3.22-36.el7_4.1.aarch64"
        },
        "product_reference": "procmail-debuginfo-0:3.22-36.el7_4.1.aarch64",
        "relates_to_product_reference": "7Workstation-7.4.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "procmail-debuginfo-0:3.22-36.el7_4.1.ppc64 as a component of Red Hat Enterprise Linux Workstation (v. 7)",
          "product_id": "7Workstation-7.4.Z:procmail-debuginfo-0:3.22-36.el7_4.1.ppc64"
        },
        "product_reference": "procmail-debuginfo-0:3.22-36.el7_4.1.ppc64",
        "relates_to_product_reference": "7Workstation-7.4.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "procmail-debuginfo-0:3.22-36.el7_4.1.ppc64le as a component of Red Hat Enterprise Linux Workstation (v. 7)",
          "product_id": "7Workstation-7.4.Z:procmail-debuginfo-0:3.22-36.el7_4.1.ppc64le"
        },
        "product_reference": "procmail-debuginfo-0:3.22-36.el7_4.1.ppc64le",
        "relates_to_product_reference": "7Workstation-7.4.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "procmail-debuginfo-0:3.22-36.el7_4.1.s390x as a component of Red Hat Enterprise Linux Workstation (v. 7)",
          "product_id": "7Workstation-7.4.Z:procmail-debuginfo-0:3.22-36.el7_4.1.s390x"
        },
        "product_reference": "procmail-debuginfo-0:3.22-36.el7_4.1.s390x",
        "relates_to_product_reference": "7Workstation-7.4.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "procmail-debuginfo-0:3.22-36.el7_4.1.x86_64 as a component of Red Hat Enterprise Linux Workstation (v. 7)",
          "product_id": "7Workstation-7.4.Z:procmail-debuginfo-0:3.22-36.el7_4.1.x86_64"
        },
        "product_reference": "procmail-debuginfo-0:3.22-36.el7_4.1.x86_64",
        "relates_to_product_reference": "7Workstation-7.4.Z"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2017-16844",
      "cwe": {
        "id": "CWE-122",
        "name": "Heap-based Buffer Overflow"
      },
      "discovery_date": "2017-09-22T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1500070"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A heap-based buffer overflow flaw was found in procmail\u0027s formail utility. A remote attacker could send a specially crafted email that, when processed by formail, could cause formail to crash or, possibly, execute arbitrary code as the user running formail.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "procmail: Heap-based buffer overflow in loadbuf function in formisc.c",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This issue affects the versions of procmail as shipped with Red Hat Enterprise Linux 5. Red Hat Enterprise Linux 5 is now in Extended Life Cycle phase of the support and maintenance life cycle. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.\n\nThis issue affects the versions of procmail as shipped with Red Hat Enterprise Linux 6. Red Hat Enterprise Linux 6 is now in Production 3 Phase of the support and maintenance life cycle. This has been rated as having Important security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "7Client-optional-7.4.Z:procmail-0:3.22-36.el7_4.1.aarch64",
          "7Client-optional-7.4.Z:procmail-0:3.22-36.el7_4.1.ppc64",
          "7Client-optional-7.4.Z:procmail-0:3.22-36.el7_4.1.ppc64le",
          "7Client-optional-7.4.Z:procmail-0:3.22-36.el7_4.1.s390x",
          "7Client-optional-7.4.Z:procmail-0:3.22-36.el7_4.1.src",
          "7Client-optional-7.4.Z:procmail-0:3.22-36.el7_4.1.x86_64",
          "7Client-optional-7.4.Z:procmail-debuginfo-0:3.22-36.el7_4.1.aarch64",
          "7Client-optional-7.4.Z:procmail-debuginfo-0:3.22-36.el7_4.1.ppc64",
          "7Client-optional-7.4.Z:procmail-debuginfo-0:3.22-36.el7_4.1.ppc64le",
          "7Client-optional-7.4.Z:procmail-debuginfo-0:3.22-36.el7_4.1.s390x",
          "7Client-optional-7.4.Z:procmail-debuginfo-0:3.22-36.el7_4.1.x86_64",
          "7Server-7.4.Z:procmail-0:3.22-36.el7_4.1.aarch64",
          "7Server-7.4.Z:procmail-0:3.22-36.el7_4.1.ppc64",
          "7Server-7.4.Z:procmail-0:3.22-36.el7_4.1.ppc64le",
          "7Server-7.4.Z:procmail-0:3.22-36.el7_4.1.s390x",
          "7Server-7.4.Z:procmail-0:3.22-36.el7_4.1.src",
          "7Server-7.4.Z:procmail-0:3.22-36.el7_4.1.x86_64",
          "7Server-7.4.Z:procmail-debuginfo-0:3.22-36.el7_4.1.aarch64",
          "7Server-7.4.Z:procmail-debuginfo-0:3.22-36.el7_4.1.ppc64",
          "7Server-7.4.Z:procmail-debuginfo-0:3.22-36.el7_4.1.ppc64le",
          "7Server-7.4.Z:procmail-debuginfo-0:3.22-36.el7_4.1.s390x",
          "7Server-7.4.Z:procmail-debuginfo-0:3.22-36.el7_4.1.x86_64",
          "7Server-Alt-7.4.Z:procmail-0:3.22-36.el7_4.1.aarch64",
          "7Server-Alt-7.4.Z:procmail-0:3.22-36.el7_4.1.ppc64",
          "7Server-Alt-7.4.Z:procmail-0:3.22-36.el7_4.1.ppc64le",
          "7Server-Alt-7.4.Z:procmail-0:3.22-36.el7_4.1.s390x",
          "7Server-Alt-7.4.Z:procmail-0:3.22-36.el7_4.1.src",
          "7Server-Alt-7.4.Z:procmail-0:3.22-36.el7_4.1.x86_64",
          "7Server-Alt-7.4.Z:procmail-debuginfo-0:3.22-36.el7_4.1.aarch64",
          "7Server-Alt-7.4.Z:procmail-debuginfo-0:3.22-36.el7_4.1.ppc64",
          "7Server-Alt-7.4.Z:procmail-debuginfo-0:3.22-36.el7_4.1.ppc64le",
          "7Server-Alt-7.4.Z:procmail-debuginfo-0:3.22-36.el7_4.1.s390x",
          "7Server-Alt-7.4.Z:procmail-debuginfo-0:3.22-36.el7_4.1.x86_64",
          "7Workstation-7.4.Z:procmail-0:3.22-36.el7_4.1.aarch64",
          "7Workstation-7.4.Z:procmail-0:3.22-36.el7_4.1.ppc64",
          "7Workstation-7.4.Z:procmail-0:3.22-36.el7_4.1.ppc64le",
          "7Workstation-7.4.Z:procmail-0:3.22-36.el7_4.1.s390x",
          "7Workstation-7.4.Z:procmail-0:3.22-36.el7_4.1.src",
          "7Workstation-7.4.Z:procmail-0:3.22-36.el7_4.1.x86_64",
          "7Workstation-7.4.Z:procmail-debuginfo-0:3.22-36.el7_4.1.aarch64",
          "7Workstation-7.4.Z:procmail-debuginfo-0:3.22-36.el7_4.1.ppc64",
          "7Workstation-7.4.Z:procmail-debuginfo-0:3.22-36.el7_4.1.ppc64le",
          "7Workstation-7.4.Z:procmail-debuginfo-0:3.22-36.el7_4.1.s390x",
          "7Workstation-7.4.Z:procmail-debuginfo-0:3.22-36.el7_4.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2017-16844"
        },
        {
          "category": "external",
          "summary": "RHBZ#1500070",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1500070"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2017-16844",
          "url": "https://www.cve.org/CVERecord?id=CVE-2017-16844"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2017-16844",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-16844"
        }
      ],
      "release_date": "2017-09-22T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2017-11-28T22:02:16+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "7Client-optional-7.4.Z:procmail-0:3.22-36.el7_4.1.aarch64",
            "7Client-optional-7.4.Z:procmail-0:3.22-36.el7_4.1.ppc64",
            "7Client-optional-7.4.Z:procmail-0:3.22-36.el7_4.1.ppc64le",
            "7Client-optional-7.4.Z:procmail-0:3.22-36.el7_4.1.s390x",
            "7Client-optional-7.4.Z:procmail-0:3.22-36.el7_4.1.src",
            "7Client-optional-7.4.Z:procmail-0:3.22-36.el7_4.1.x86_64",
            "7Client-optional-7.4.Z:procmail-debuginfo-0:3.22-36.el7_4.1.aarch64",
            "7Client-optional-7.4.Z:procmail-debuginfo-0:3.22-36.el7_4.1.ppc64",
            "7Client-optional-7.4.Z:procmail-debuginfo-0:3.22-36.el7_4.1.ppc64le",
            "7Client-optional-7.4.Z:procmail-debuginfo-0:3.22-36.el7_4.1.s390x",
            "7Client-optional-7.4.Z:procmail-debuginfo-0:3.22-36.el7_4.1.x86_64",
            "7Server-7.4.Z:procmail-0:3.22-36.el7_4.1.aarch64",
            "7Server-7.4.Z:procmail-0:3.22-36.el7_4.1.ppc64",
            "7Server-7.4.Z:procmail-0:3.22-36.el7_4.1.ppc64le",
            "7Server-7.4.Z:procmail-0:3.22-36.el7_4.1.s390x",
            "7Server-7.4.Z:procmail-0:3.22-36.el7_4.1.src",
            "7Server-7.4.Z:procmail-0:3.22-36.el7_4.1.x86_64",
            "7Server-7.4.Z:procmail-debuginfo-0:3.22-36.el7_4.1.aarch64",
            "7Server-7.4.Z:procmail-debuginfo-0:3.22-36.el7_4.1.ppc64",
            "7Server-7.4.Z:procmail-debuginfo-0:3.22-36.el7_4.1.ppc64le",
            "7Server-7.4.Z:procmail-debuginfo-0:3.22-36.el7_4.1.s390x",
            "7Server-7.4.Z:procmail-debuginfo-0:3.22-36.el7_4.1.x86_64",
            "7Server-Alt-7.4.Z:procmail-0:3.22-36.el7_4.1.aarch64",
            "7Server-Alt-7.4.Z:procmail-0:3.22-36.el7_4.1.ppc64",
            "7Server-Alt-7.4.Z:procmail-0:3.22-36.el7_4.1.ppc64le",
            "7Server-Alt-7.4.Z:procmail-0:3.22-36.el7_4.1.s390x",
            "7Server-Alt-7.4.Z:procmail-0:3.22-36.el7_4.1.src",
            "7Server-Alt-7.4.Z:procmail-0:3.22-36.el7_4.1.x86_64",
            "7Server-Alt-7.4.Z:procmail-debuginfo-0:3.22-36.el7_4.1.aarch64",
            "7Server-Alt-7.4.Z:procmail-debuginfo-0:3.22-36.el7_4.1.ppc64",
            "7Server-Alt-7.4.Z:procmail-debuginfo-0:3.22-36.el7_4.1.ppc64le",
            "7Server-Alt-7.4.Z:procmail-debuginfo-0:3.22-36.el7_4.1.s390x",
            "7Server-Alt-7.4.Z:procmail-debuginfo-0:3.22-36.el7_4.1.x86_64",
            "7Workstation-7.4.Z:procmail-0:3.22-36.el7_4.1.aarch64",
            "7Workstation-7.4.Z:procmail-0:3.22-36.el7_4.1.ppc64",
            "7Workstation-7.4.Z:procmail-0:3.22-36.el7_4.1.ppc64le",
            "7Workstation-7.4.Z:procmail-0:3.22-36.el7_4.1.s390x",
            "7Workstation-7.4.Z:procmail-0:3.22-36.el7_4.1.src",
            "7Workstation-7.4.Z:procmail-0:3.22-36.el7_4.1.x86_64",
            "7Workstation-7.4.Z:procmail-debuginfo-0:3.22-36.el7_4.1.aarch64",
            "7Workstation-7.4.Z:procmail-debuginfo-0:3.22-36.el7_4.1.ppc64",
            "7Workstation-7.4.Z:procmail-debuginfo-0:3.22-36.el7_4.1.ppc64le",
            "7Workstation-7.4.Z:procmail-debuginfo-0:3.22-36.el7_4.1.s390x",
            "7Workstation-7.4.Z:procmail-debuginfo-0:3.22-36.el7_4.1.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2017:3269"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "products": [
            "7Client-optional-7.4.Z:procmail-0:3.22-36.el7_4.1.aarch64",
            "7Client-optional-7.4.Z:procmail-0:3.22-36.el7_4.1.ppc64",
            "7Client-optional-7.4.Z:procmail-0:3.22-36.el7_4.1.ppc64le",
            "7Client-optional-7.4.Z:procmail-0:3.22-36.el7_4.1.s390x",
            "7Client-optional-7.4.Z:procmail-0:3.22-36.el7_4.1.src",
            "7Client-optional-7.4.Z:procmail-0:3.22-36.el7_4.1.x86_64",
            "7Client-optional-7.4.Z:procmail-debuginfo-0:3.22-36.el7_4.1.aarch64",
            "7Client-optional-7.4.Z:procmail-debuginfo-0:3.22-36.el7_4.1.ppc64",
            "7Client-optional-7.4.Z:procmail-debuginfo-0:3.22-36.el7_4.1.ppc64le",
            "7Client-optional-7.4.Z:procmail-debuginfo-0:3.22-36.el7_4.1.s390x",
            "7Client-optional-7.4.Z:procmail-debuginfo-0:3.22-36.el7_4.1.x86_64",
            "7Server-7.4.Z:procmail-0:3.22-36.el7_4.1.aarch64",
            "7Server-7.4.Z:procmail-0:3.22-36.el7_4.1.ppc64",
            "7Server-7.4.Z:procmail-0:3.22-36.el7_4.1.ppc64le",
            "7Server-7.4.Z:procmail-0:3.22-36.el7_4.1.s390x",
            "7Server-7.4.Z:procmail-0:3.22-36.el7_4.1.src",
            "7Server-7.4.Z:procmail-0:3.22-36.el7_4.1.x86_64",
            "7Server-7.4.Z:procmail-debuginfo-0:3.22-36.el7_4.1.aarch64",
            "7Server-7.4.Z:procmail-debuginfo-0:3.22-36.el7_4.1.ppc64",
            "7Server-7.4.Z:procmail-debuginfo-0:3.22-36.el7_4.1.ppc64le",
            "7Server-7.4.Z:procmail-debuginfo-0:3.22-36.el7_4.1.s390x",
            "7Server-7.4.Z:procmail-debuginfo-0:3.22-36.el7_4.1.x86_64",
            "7Server-Alt-7.4.Z:procmail-0:3.22-36.el7_4.1.aarch64",
            "7Server-Alt-7.4.Z:procmail-0:3.22-36.el7_4.1.ppc64",
            "7Server-Alt-7.4.Z:procmail-0:3.22-36.el7_4.1.ppc64le",
            "7Server-Alt-7.4.Z:procmail-0:3.22-36.el7_4.1.s390x",
            "7Server-Alt-7.4.Z:procmail-0:3.22-36.el7_4.1.src",
            "7Server-Alt-7.4.Z:procmail-0:3.22-36.el7_4.1.x86_64",
            "7Server-Alt-7.4.Z:procmail-debuginfo-0:3.22-36.el7_4.1.aarch64",
            "7Server-Alt-7.4.Z:procmail-debuginfo-0:3.22-36.el7_4.1.ppc64",
            "7Server-Alt-7.4.Z:procmail-debuginfo-0:3.22-36.el7_4.1.ppc64le",
            "7Server-Alt-7.4.Z:procmail-debuginfo-0:3.22-36.el7_4.1.s390x",
            "7Server-Alt-7.4.Z:procmail-debuginfo-0:3.22-36.el7_4.1.x86_64",
            "7Workstation-7.4.Z:procmail-0:3.22-36.el7_4.1.aarch64",
            "7Workstation-7.4.Z:procmail-0:3.22-36.el7_4.1.ppc64",
            "7Workstation-7.4.Z:procmail-0:3.22-36.el7_4.1.ppc64le",
            "7Workstation-7.4.Z:procmail-0:3.22-36.el7_4.1.s390x",
            "7Workstation-7.4.Z:procmail-0:3.22-36.el7_4.1.src",
            "7Workstation-7.4.Z:procmail-0:3.22-36.el7_4.1.x86_64",
            "7Workstation-7.4.Z:procmail-debuginfo-0:3.22-36.el7_4.1.aarch64",
            "7Workstation-7.4.Z:procmail-debuginfo-0:3.22-36.el7_4.1.ppc64",
            "7Workstation-7.4.Z:procmail-debuginfo-0:3.22-36.el7_4.1.ppc64le",
            "7Workstation-7.4.Z:procmail-debuginfo-0:3.22-36.el7_4.1.s390x",
            "7Workstation-7.4.Z:procmail-debuginfo-0:3.22-36.el7_4.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "procmail: Heap-based buffer overflow in loadbuf function in formisc.c"
    }
  ]
}

cve-2017-16844

Vulnerability from cvelistv5

Published

2017-11-16 15:00

Modified

2024-08-05 20:35

Severity ?

Summary

Heap-based buffer overflow in the loadbuf function in formisc.c in formail in procmail 3.22 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted e-mail message because of a hardcoded realloc size, a different vulnerability than CVE-2014-3618.

References

▼	URL	Tags
	https://lists.debian.org/debian-lts-announce/2017/11/msg00019.html	mailing-list, x_refsource_MLIST
	https://access.redhat.com/errata/RHSA-2017:3269	vendor-advisory, x_refsource_REDHAT
	https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=876511	x_refsource_MISC
	https://www.debian.org/security/2017/dsa-4041	vendor-advisory, x_refsource_DEBIAN
	http://www.securitytracker.com/id/1039844	vdb-entry, x_refsource_SECTRACK

Impacted products

Vendor

Product

Version

▼

n/a

Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T20:35:21.217Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "[debian-lts-announce] 20171118 [SECURITY] [DLA 1173-1] procmail security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2017/11/msg00019.html"
          },
          {
            "name": "RHSA-2017:3269",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2017:3269"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=876511"
          },
          {
            "name": "DSA-4041",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2017/dsa-4041"
          },
          {
            "name": "1039844",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id/1039844"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2017-11-16T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Heap-based buffer overflow in the loadbuf function in formisc.c in formail in procmail 3.22 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted e-mail message because of a hardcoded realloc size, a different vulnerability than CVE-2014-3618."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-02-02T10:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "[debian-lts-announce] 20171118 [SECURITY] [DLA 1173-1] procmail security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2017/11/msg00019.html"
        },
        {
          "name": "RHSA-2017:3269",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2017:3269"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=876511"
        },
        {
          "name": "DSA-4041",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2017/dsa-4041"
        },
        {
          "name": "1039844",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id/1039844"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2017-16844",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Heap-based buffer overflow in the loadbuf function in formisc.c in formail in procmail 3.22 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted e-mail message because of a hardcoded realloc size, a different vulnerability than CVE-2014-3618."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "[debian-lts-announce] 20171118 [SECURITY] [DLA 1173-1] procmail security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2017/11/msg00019.html"
            },
            {
              "name": "RHSA-2017:3269",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2017:3269"
            },
            {
              "name": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=876511",
              "refsource": "MISC",
              "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=876511"
            },
            {
              "name": "DSA-4041",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2017/dsa-4041"
            },
            {
              "name": "1039844",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id/1039844"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2017-16844",
    "datePublished": "2017-11-16T15:00:00",
    "dateReserved": "2017-11-16T00:00:00",
    "dateUpdated": "2024-08-05T20:35:21.217Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted