📦

sendmail

Vendor: sendmail

Login to add this product to WatchStack
Actively Exploited 0 CISA KEV List
PoC / Exploits 9 Code Available
Total RCEs 1 Remote Access
Total CVEs 69 Total Indexed
Avg. EPSS 8.77% Exploit Prob.
Latest CVE CVE-2023-51765 Dec 24

Security Vulnerability Index

Page 2 / 7
7.6 CVSS
CVE-2006-0058
RCE Exploit Found

Signal handler race condition in Sendmail 8.13.x before 8.13.6 allows remote attackers to execute arbitrary code by triggering timeouts in a way that causes the setjmp and longjmp function calls to be interrupted and modify unexpected memory locations.

EPSS: 28.14%
5.0 CVSS
CVE-2005-2070

The ClamAV Mail fILTER (clamav-milter) 0.84 through 0.85d, when used in Sendmail using long timeouts, allows remote attackers to cause a denial of service by keeping an open connection, which prevents ClamAV from reloading.

EPSS: 1.66%
5.0 CVSS
CVE-2003-0688

The DNS map code in Sendmail 8.12.8 and earlier, when using the "enhdnsbl" feature, does not properly initialize certain data structures, which allows remote attackers to cause a denial of service (process crash) via an invalid DNS response that causes Sendmail to free incorrect data.

EPSS: 3.56%
7.5 CVSS
CVE-2003-0681
Exploit Found

A "potential buffer overflow in ruleset parsing" for Sendmail 8.12.9, when using the nonstandard rulesets (1) recipient (2), final, or (3) mailer-specific envelope recipients, has unknown consequences.

EPSS: 22.36%
10.0 CVSS
CVE-2003-0694

The prescan function in Sendmail 8.12.9 allows remote attackers to execute arbitrary code via buffer overflow attacks, as demonstrated using the parseaddr function in parseaddr.c.

EPSS: 66.18%
7.2 CVSS
CVE-2003-0308

The Sendmail 8.12.3 package in Debian GNU/Linux 3.0 does not securely create temporary files, which could allow local users to gain additional privileges via (1) expn, (2) checksendmail, or (3) doublebounce.pl.

EPSS: 0.40%
10.0 CVSS
CVE-2003-0161
Exploit Found

The prescan() function in the address parser (parseaddr.c) in Sendmail before 8.12.9 does not properly handle certain conversions from char and int types, which can cause a length check to be disabled when Sendmail misinterprets an input value as a special "NOCHAR" control value, allowing attackers to cause a denial of service and possibly execute arbitrary code via a buffer overflow attack using messages, a different vulnerability than CVE-2002-1337.

EPSS: 38.19%
10.0 CVSS
CVE-2002-1337
Exploit Found

Buffer overflow in Sendmail 5.79 to 8.12.7 allows remote attackers to execute arbitrary code via certain formatted address fields, related to sender and recipient header comments as processed by the crackaddr function of headers.c.

EPSS: 72.20%
6.4 CVSS
CVE-2002-2423

Sendmail 8.12.0 through 8.12.6 truncates log messages longer than 100 characters, which allows remote attackers to prevent the IP address from being logged via a long IDENT response.

EPSS: 1.17%
7.5 CVSS
CVE-2002-2261

Sendmail 8.9.0 through 8.12.6 allows remote attackers to bypass relaying restrictions enforced by the 'check_relay' function by spoofing a blank DNS hostname.

EPSS: 2.00%