CVE-2007-5740
The format string protection mechanism in IMAPD for Perdition Mail Retrieval Proxy 1.17 and earlier allows remote attackers to execute arbitrary code via an IMAP tag with a null byte followed by a format string specifier, which is not counted by the…
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 12.4%, higher than 96% of all known CVEs. Patch or mitigate before the next change window.
Description
The format string protection mechanism in IMAPD for Perdition Mail Retrieval Proxy 1.17 and earlier allows remote attackers to execute arbitrary code via an IMAP tag with a null byte followed by a format string specifier, which is not counted by the mechanism.
- CVSS 2.0
- 7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
- EPSS
- 12.38% probability · 96th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-134
- Affected
- vergenet/perdition mail retrieval proxy
- Source
- cve@mitre.org
References
- http://archives.neohapsis.com/archives/fulldisclosure/2007-10/0889.htmlPatch
- http://secunia.com/advisories/27458Vendor Advisory
- http://secunia.com/advisories/27520Vendor Advisory
- http://www.debian.org/security/2007/dsa-1398
- http://www.sec-consult.com/300.html
- http://www.securityfocus.com/archive/1/483034/100/0/threaded
- http://www.securityfocus.com/bid/26270
- http://www.securitytracker.com/id?1018883
- http://www.vergenet.net/linux/perdition/ChangeLog.shtml
- http://www.vupen.com/english/advisories/2007/3677
- https://exchange.xforce.ibmcloud.com/vulnerabilities/38184
- http://archives.neohapsis.com/archives/fulldisclosure/2007-10/0889.htmlPatch
- http://secunia.com/advisories/27458Vendor Advisory
- http://secunia.com/advisories/27520Vendor Advisory
- http://www.debian.org/security/2007/dsa-1398
- http://www.sec-consult.com/300.html
- http://www.securityfocus.com/archive/1/483034/100/0/threaded
- http://www.securityfocus.com/bid/26270
- http://www.securitytracker.com/id?1018883
- http://www.vergenet.net/linux/perdition/ChangeLog.shtml
- http://www.vupen.com/english/advisories/2007/3677
- https://exchange.xforce.ibmcloud.com/vulnerabilities/38184
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.