[IT-SecNots] [SECURITY] [DSA 4041-1] procmail security update

[Salvatore Bonaccorso <carnil AT debian.org>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

- -------------------------------------------------------------------------
Debian Security Advisory DSA-4041-1                   security AT debian.org
https://www.debian.org/security/                     Salvatore Bonaccorso
November 19, 2017                     https://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package        : procmail
CVE ID         : CVE-2017-16844
Debian Bug     : 876511

Jakub Wilk reported a heap-based buffer overflow vulnerability in
procmail's formail utility when processing specially-crafted email
headers. A remote attacker could use this flaw to cause formail to
crash, resulting in a denial of service or data loss.

For the oldstable distribution (jessie), this problem has been fixed
in version 3.22-24+deb8u1.

For the stable distribution (stretch), this problem has been fixed in
version 3.22-25+deb9u1.

We recommend that you upgrade your procmail packages.

For the detailed security status of procmail please refer to its
security tracker page at:
https://security-tracker.debian.org/tracker/procmail

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

Mailing list: debian-security-announce AT lists.debian.org
-----BEGIN PGP SIGNATURE-----

iQKTBAEBCgB9FiEERkRAmAjBceBVMd3uBUy48xNDz0QFAloRRZhfFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDQ2
NDQ0MDk4MDhDMTcxRTA1NTMxRERFRTA1NENCOEYzMTM0M0NGNDQACgkQBUy48xND
z0SIMw/9HmY34RnbN7WBUgZGc2LeJv7NVDIvBJfiuI/IT/tcvDN1zxb5YcmCRo5O
d5cpPB1JBLohmiVkW8c2Lc4RcwyY8jgB/MJFTOlr7nqaNSxjZlyWpeQPmYaVE7XL
kvr16PVtYu+hR7jhfxWKxuSn5SGc48RApvT6h0hV4S1FrAFt+wrbJ2LH9BDYNYTI
JCKX5ECXKoiwUuRe5CzNyhdMzz5mF0kzhl1qMwuqWAB2lXOhab1xrASZCdD7AcYE
MUPDGESjDnBinldG07a2/bbbpl0CpBuuY/2QVhLH2yXaPAy/sI/YkBYJKfRJID9A
5y4lAMOIAwjIZxbjFrbcPtUcuJkPWr1mzzUdT/B9HrsyFKYIuiP55KxxQS9LNmKI
0uX4pNHAfmbNN64mQJDI9HjtYRct5+0wbo5xD7kS42sqzO8LngKRlxRJupQQkOMk
6byodKctrOIakVZEm3iveYKBiNVVHobs6IBA49KVfxVf0a3pyPTBxe08cJHifA4A
Ns6zxuptEbGmjIgXZiMJ+zEEctQvukx+FffyDjSniBTtNnTORwygchlZPI3cKl2c
vvADJZU9+Te657OUwgQPnKLPWLO8kW9ACz0aHa4OaxMIrZ71tjvIwUGuQh+D6AQt
Azy/l/HK7b5hQLzBx44r2FV+B38jQ7KlH1fzSGhfzXdF853aHRI=
=DBTD
-----END PGP SIGNATURE-----