Unscored severity · published Jun 15, 2005
CVE-2005-1266
Apache SpamAssassin 3.0.1, 3.0.2, and 3.0.3 allows remote attackers to cause a denial of service (CPU consumption and slowdown) via a message with a long Content-Type header…
–
CVSS
8.3%
EPSS
No
On KEV
Description
Apache SpamAssassin 3.0.1, 3.0.2, and 3.0.3 allows remote attackers to cause a denial of service (CPU consumption and slowdown) via a message with a long Content-Type header without any boundaries.
Exploitation
Is it being used?
Exploit prediction (EPSS)8.3% · higher than 95% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SP
Spamassassin · Apache
3.0.1; 3.0.2; 3.0.3 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2005-1266
CVE.org
https://www.cve.org/CVERecord?id=CVE-2005-1266
Patch
http://bugs.gentoo.org/show_bug.cgi?id=94722
mail-archives.apache.org
http://mail-archives.apache.org/mod_mbox/spamassassin-announce/200506.mbox/%3c17072.35054.586017.822288%40proton.pathname.com%3e
Patch
http://security.gentoo.org/glsa/glsa-200506-17.xml
www.debian.org
http://www.debian.org/security/2005/dsa-736
www.mandriva.com
http://www.mandriva.com/security/advisories?name=MDKSA-2005:106
www.redhat.com
http://www.redhat.com/support/errata/RHSA-2005-498.html
More from Spamassassin
9.8
CVE-2020-1946
In Apache SpamAssassin before 3.4.5, malicious rule configuration (.cf) files can be configured to run system commands without any output or errors
9.8
CVE-2018-11780
A potential Remote Code Execution bug exists with the PDFInfo plugin in Apache SpamAssassin before 3.4.2
8.1
CVE-2020-1931
A command execution issue was found in Apache SpamAssassin prior to 3.4.3
8.1
CVE-2020-1930
A command execution issue was found in Apache SpamAssassin prior to 3.4.3
7.8
CVE-2018-11781
Apache SpamAssassin 3.4.2 fixes a local user code injection in the meta rule syntax