Summary
It was discovered that SpamAssassin incorrectly handled certain unclosed
tags in emails. A remote attacker could possibly use this issue to cause a
denial of service. (CVE-2017-15705)
It was discovered that SpamAssassin incorrectly handled the PDFInfo plugin.
A remote attacker could possibly use this issue to execute arbitrary code.
(CVE-2018-11780)
It was discovered that SpamAssassin incorrectly handled meta rule syntax. A
local attacker could possibly use this issue to execute arbitrary code.
(CVE-2018-11781)
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 14.04 LTS 14.04:LTS | spamassassin | 3.4.2-0ubuntu0.14.04.1 |
| Ubuntu · 16.04 LTS 16.04:LTS | spamassassin | 3.4.2-0ubuntu0.16.04.1 |
| Ubuntu · 18.04 LTS 18.04:LTS | spamassassin | 3.4.2-0ubuntu0.18.04.1 |
Vulnerabilities 3
-
Unscored —
A denial of service vulnerability was identified that exists in Apache SpamAssassin before 3.4.2. The vulnerability ari…
-
Unscored —CVE-2018-11780 EPSS 11%
A potential Remote Code Execution bug exists with the PDFInfo plugin in Apache SpamAssassin before 3.4.2.
-
Unscored —
Apache SpamAssassin 3.4.2 fixes a local user code injection in the meta rule syntax.