Skip to content
OpenAdvisories
Unscored Public exploit CVE-2019-11395 EUVD-2019-3073GHSA-7v86-hv29-pw56

A buffer overflow in MailCarrier 2.51 allows remote attackers to execute arbitrary code via a long string, as demonstrated by SMTP RCPT TO,…

Published Apr 21, 2019 · Updated Aug 4, 2024 · Assigned by mitre

Description

A buffer overflow in MailCarrier 2.51 allows remote attackers to execute arbitrary code via a long string, as demonstrated by SMTP RCPT TO, POP3 USER, POP3 LIST, POP3 TOP, or POP3 RETR.

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 3 repositories

  • RedAlien00/CVE-2019-11395 ★ 1 · Dec 25, 2023

    MailCarrier 2.51 - POP3 'USER' Buffer Overflow

  • RafaelBicas/CVE-2019-11395 ★ 0 · Apr 3, 2025

    Proof of concept with the academic purpose to understand the Buffer Overflow vulnerability using as background the CVE-2019-11395

  • caioprince/CVE-2019-11395 ★ 0 · Apr 21, 2024

    A exploit for the CVE-2019-11395 vulnerability in the MailCarrier 2.51 email application, enabling remote code execution.

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

References