SE
Product
Sendmail
33
CVEs
0
On KEV
7.5
Max CVSS
0
New 30D
Severity mix
Critical 0High 2Medium 1Low 0
Watch
Add Sendmail to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2006-4434 | 7.5 | Aug 29 | Use-after-free vulnerability in Sendmail before 8.13.8 allows remote attackers to cause a denial of service (crash) via a long "header line", which causes a previously freed… Affected: before 8.13.8 |
| CVE-2021-3618 | 7.4 | Mar 23 | ALPACA is an application layer protocol content confusion attack, exploiting TLS servers implementing different protocols but using compatible certificates, such as multi-domain… Affected: before 8.17 |
| CVE-2023-51765 | 5.3 | Dec 24 | sendmail through 8.17.2 allows SMTP smuggling in certain configurations Affected: before 8.18.0.2 |
| CVE-2014-3956 | – | Jun 4 | The sm_close_on_exec function in conf.c in sendmail before 8.14.9 has arguments in the wrong order, and consequently skips setting expected FD_CLOEXEC flags, which allows local… Affected: through 8.14.8; 8.6.7; 8.7.6; 8.7.7; 8.7.8; 8.7.9; +34 more |
| CVE-2009-4565 | – | Jan 4 | sendmail before 8.14.4 does not properly handle a '\0' character in a Common Name (CN) field of an X.509 certificate, which (1) allows man-in-the-middle attackers to spoof… Affected: through 8.14.3; 2.6; 2.6.1; 3.0; 3.0.1; 4.1; +34 more |
| CVE-2009-1490 | – | May 5 | Heap-based buffer overflow in Sendmail before 8.13.2 allows remote attackers to cause a denial of service (daemon crash) and possibly execute arbitrary code via a long X- header,… Affected: through 8.13.1.2; 2.6; 2.6; 2.6.1; 2.6.1; 2.6.2; +34 more |
| CVE-2007-2246 | – | Apr 25 | Unspecified vulnerability in HP-UX B.11.00 and B.11.11, when running sendmail 8.9.3 or 8.11.1; and HP-UX B.11.23 when running sendmail 8.11.1; allows remote attackers to cause a… Affected: 8.9.3; 8.11.1 |
| CVE-2006-7176 | – | Mar 27 | The version of Sendmail 8.13.1-2 on Red Hat Enterprise Linux 4 Update 4 and earlier does not reject the "localhost.localdomain" domain name for e-mail messages that come from… Affected: 8.13.1.2 |
| CVE-2006-7175 | – | Mar 27 | The version of Sendmail 8.13.1-2 on Red Hat Enterprise Linux 4 Update 4 and earlier does not allow the administrator to disable SSLv2 encryption, which could cause less secure… Affected: 8.13.1.2 |
| CVE-2006-1173 | – | Jun 7 | Sendmail before 8.13.7 allows remote attackers to cause a denial of service via deeply nested, malformed multipart MIME messages that exhaust the stack during the recursive… Affected: through 8.13.6; 8.8.8; 8.9.0; 8.9.1; 8.9.2; 8.9.3; +34 more |
| CVE-2006-0058 | – | Mar 22 | Signal handler race condition in Sendmail 8.13.x before 8.13.6 allows remote attackers to execute arbitrary code by triggering timeouts in a way that causes the setjmp and longjmp… Affected: 8.13.0; 8.13.1; 8.13.2; 8.13.3; 8.13.4; 8.13.5 |
| CVE-2005-2070 | – | Jun 29 | The ClamAV Mail fILTER (clamav-milter) 0.84 through 0.85d, when used in Sendmail using long timeouts, allows remote attackers to cause a denial of service by keeping an open… Affected: 8.8.8; 8.9.0; 8.9.1; 8.9.2; 8.9.3; 8.10; +27 more |
| CVE-2003-0688 | – | Oct 20 | The DNS map code in Sendmail 8.12.8 and earlier, when using the "enhdnsbl" feature, does not properly initialize certain data structures, which allows remote attackers to cause a… Affected: 8.12.1; 8.12.2; 8.12.3; 8.12.4; 8.12.5; 8.12.6; +2 more |
| CVE-2003-0681 | – | Oct 6 | A "potential buffer overflow in ruleset parsing" for Sendmail 8.12.9, when using the nonstandard rulesets (1) recipient (2), final, or (3) mailer-specific envelope recipients, has… Affected: 2.6; 2.6.1; 2.6.2; 3.0; 3.0.1; 3.0.2; +31 more |
| CVE-2003-0694 | – | Oct 6 | The prescan function in Sendmail 8.12.9 allows remote attackers to execute arbitrary code via buffer overflow attacks, as demonstrated using the parseaddr function in parseaddr.c Affected: 2.6; 2.6.1; 2.6.2; 3.0; 3.0.1; 3.0.2; +31 more |
| CVE-2003-0308 | – | May 15 | The Sendmail 8.12.3 package in Debian GNU/Linux 3.0 does not securely create temporary files, which could allow local users to gain additional privileges via (1) expn, (2)… Affected: 8.9.3; 8.12.3; 8.12.9 |
| CVE-2003-0161 | – | Apr 2 | The prescan() function in the address parser (parseaddr.c) in Sendmail before 8.12.9 does not properly handle certain conversions from char and int types, which can cause a length… Affected: 2.6; 2.6.1; 2.6.2; 3.0; 3.0.1; 3.0.2; +29 more |
| CVE-2002-1337 | – | Mar 7 | Buffer overflow in Sendmail 5.79 to 8.12.7 allows remote attackers to execute arbitrary code via certain formatted address fields, related to sender and recipient header comments… Affected: before 8.9.3; 8.10.0 before 8.11.6; 8.12.0 before 8.12.8 |
| CVE-2002-2423 | – | Dec 31 | Sendmail 8.12.0 through 8.12.6 truncates log messages longer than 100 characters, which allows remote attackers to prevent the IP address from being logged via a long IDENT… Affected: 8.12.0; 8.12.1; 8.12.2; 8.12.3; 8.12.4; 8.12.5; +1 more |
| CVE-2002-2261 | – | Dec 31 | Sendmail 8.9.0 through 8.12.6 allows remote attackers to bypass relaying restrictions enforced by the 'check_relay' function by spoofing a blank DNS hostname Affected: 8.9.0; 8.9.1; 8.9.2; 8.9.3; 8.10; 8.10.0; +22 more |
| CVE-2002-1827 | – | Dec 31 | Sendmail 8.9.0 through 8.12.3 allows local users to cause a denial of service by obtaining an exclusive lock on the (1) alias, (2) map, (3) statistics, and (4) pid files Affected: 8.9.0; 8.9.1; 8.9.2; 8.9.3; 8.10; 8.10.1; +17 more |
| CVE-2002-1165 | – | Oct 11 | Sendmail Consortium's Restricted Shell (SMRSH) in Sendmail 8.12.6, 8.11.6-15, and possibly other versions after 8.11 from 5/19/1998, allows attackers to bypass the intended… Affected: 8.12.0; 8.12.1; 8.12.2; 8.12.3; 8.12.4; 8.12.5; +1 more |
| CVE-2002-0906 | – | Oct 4 | Buffer overflow in Sendmail before 8.12.5, when configured to use a custom DNS map to query TXT records, allows remote attackers to cause a denial of service and possibly execute… Affected: 8.12.0; 8.12.1; 8.12.3; 8.12.4 |
| CVE-2001-0713 | – | Oct 30 | Sendmail before 8.12.1 does not properly drop privileges when the -C option is used to load custom configuration files, which allows local users to gain privileges via malformed… Affected: through 8.12.1 |
| CVE-2001-0715 | – | Oct 30 | Sendmail before 8.12.1, without the RestrictQueueRun option enabled, allows local users to obtain potentially sensitive information about the mail queue by setting debugging flags… Affected: through 8.12.1 |
| CVE-2001-0714 | – | Oct 30 | Sendmail before 8.12.1, without the RestrictQueueRun option enabled, allows local users to cause a denial of service (data loss) by (1) setting a high initial message hop count… Affected: through 8.12.1 |
| CVE-2001-0653 | – | Sep 20 | Sendmail 8.10.0 through 8.11.5, and 8.12.0 beta, allows local users to modify process memory and possibly gain privileges via a large value in the 'category' part of debugger (-d)… Affected: 8.11.0; 8.11.1; 8.11.2; 8.11.3; 8.11.4; 8.11.5; +5 more |
| CVE-2001-1349 | – | May 28 | Sendmail before 8.11.4, and 8.12.0 before 8.12.0.Beta10, allows local users to cause a denial of service and possibly corrupt the heap and gain privileges via race conditions in… Affected: 8.10; 8.10.1; 8.10.2; 8.11.0; 8.11.1; 8.11.2; +2 more |
| CVE-1999-1592 | – | Dec 31 | Multiple unspecified vulnerabilities in sendmail 5, as installed on Sun SunOS 4.1.3_U1 and 4.1.4, have unspecified attack vectors and impact Affected: 5 |
| CVE-1999-1109 | – | Dec 22 | Sendmail before 8.10.0 allows remote attackers to cause a denial of service by sending a series of ETRN commands then disconnecting from the server, while Sendmail continues to… Affected: through 8.10.0 |
| CVE-1999-0478 | – | Dec 1 | Denial of service in HP-UX sendmail 8.8.6 related to accepting connections Affected: through 8.9.2 |
| CVE-1999-1309 | – | Aug 30 | Sendmail before 8.6.7 allows local users to gain root access via a large value in the debug (-d) command line option Affected: through 8.6.7 |
| CVE-1999-1580 | – | Aug 23 | SunOS sendmail 5.59 through 5.65 uses popen to process a forwarding host argument, which allows local users to gain root privileges by modifying the IFS (Internal Field Separator)… Affected: 5.59; 5.61; 5.65 |
Showing 33