[IT-SecNots] [SECURITY] [DSA 3019-1] procmail security update

[Salvatore Bonaccorso <carnil AT debian.org>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

- -------------------------------------------------------------------------
Debian Security Advisory DSA-3019-1                   security AT debian.org
http://www.debian.org/security/                      Salvatore Bonaccorso
September 04, 2014                     http://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package        : procmail
CVE ID         : CVE-2014-3618
Debian Bug     : 704675 760443

Boris 'pi' Piwinger and Tavis Ormandy reported a heap overflow
vulnerability in procmail's formail utility when processing
specially-crafted email headers. A remote attacker could use this flaw
to cause formail to crash, resulting in a denial of service or data
loss, or possibly execute arbitrary code.

For the stable distribution (wheezy), this problem has been fixed in
version 3.22-20+deb7u1.

For the unstable distribution (sid), this problem has been fixed in
version 3.22-22.

We recommend that you upgrade your procmail packages.

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

Mailing list: debian-security-announce AT lists.debian.org
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBCgAGBQJUCM2aAAoJEAVMuPMTQ89EiXYQAI8FfgODDJjhgCMefri5EdMy
DoykHwK7Nrblc3MkXT47Xyh7Ihrh2pfouhO6V+vX/W3tG2pquXL9aCnPXTujtpvJ
NTm5xpuoOMFUaLRXpeCwLYSzBa2h1BU2dnWFuVRSd8dNsMxsrx/Y/nI7+vyeSY30
IxR6ODjjHpBdHsi+cnYhn5wWb2kxyrOLTiDx2Q/Vwyg2GY0WojDu1r8NMs/5dUmD
MnbQaRQVYMjNww1WVr/B0T/4XDz3zLOKycD3EIj4L6mMen+H7Y6QCNc+YlZ1bKNQ
J5VBL9HmoeJiZGKThXxUFkdOWW8QMGsURl1XfN2DWzXS6qRHa5b8jjeX0EY1Utsl
liD600qjcxC08c1elS4Une3nz02y6kyH+aVyAUgHSfO0gal6x5NOF/VohEQI43vV
27vnhQMCz7uoYB8ZvohtDRKu9F0P5SXXO3hJWrX5oj3+/So9jW9xZgmxj/v2Q4eX
AU8+tAHpwcEmVmzlFnr7/irbf/25zmkQQBEYDHDtwwDIoPX6YZhru7W/Xn2Ulyvi
H6YDtdfyakv5paHN6QGE3kQEKu13SpVTp47lVV6GiZsMm1kxraGQh0q8itgis5Ko
4RVZ7I8VYbMezjHCDHEcMGU4WN4FG+LF2GkrJXRoTDwDRr6YBthMie/33Bvd9MMy
cBuaUkEYz1VJNuBHJoem
=RMOq
-----END PGP SIGNATURE-----


-- 
To UNSUBSCRIBE, email to debian-security-announce-REQUEST AT lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster AT lists.debian.org
Archive: E1XPdnp-0002Sd-RD AT master.debian.org">https://lists.debian.org/E1XPdnp-0002Sd-RD AT master.debian.org