Description
Stack-based buffer overflow in the ldif_get_line function in ldif.c of Sylpheed before 2.1.6 allows user-assisted attackers to execute arbitrary code by having local users import LDIF files with long lines.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗Advisories 2
- DSA-908-1 sylpheed-claws - buffer overflows Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-906-1 sylpheed - several Debian Security (DSA / DLA) · Mar 9, 2026
References
- SUSE-SR:2005:028 vendor-advisory
- DSA-906 vendor-advisory
- 15363 vdb-entry
- 17492 third-party-advisory
- 17831 third-party-advisory
- GLSA-200511-13 vendor-advisory
- http://sylpheed.good-day.net/en/news.html
- ADV-2005-2360 vdb-entry
- 17678 third-party-advisory
- FEDORA-2005-1063 vendor-advisory
- 17540 third-party-advisory
- sylpheed-ldif-dos(23028) vdb-entry
- 17525 third-party-advisory
- 20675 vdb-entry