Description
Multiple buffer overflows in Metamail 2.7 and earlier allow remote attackers to execute arbitrary code.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 3.0 | metamail | 2.7-45woody.2 | DSA-449 |
Advisories 1
- DSA-449 metamail - buffer overflow, format string bugs Debian Security (DSA / DLA) · Mar 9, 2026
References
- DSA-449 vendor-advisory
- SSA:2004-049 vendor-advisory
- metamail-splitmail-subject-bo(15258) vdb-entry
- O-083 third-party-advisory government-resource
- 9692 vdb-entry
- VU#513062 third-party-advisory
- 10908 third-party-advisory
- metamail-printheader-nonascii-bo(15247) vdb-entry
- MDKSA-2004:014 vendor-advisory
- RHSA-2004:073 vendor-advisory
- 20040218 metamail format string bugs and buffer overflows mailing-list
- 20040218 metamail format string bugs and buffer overflows mailing-list