CVE-2017-16844: Buffer Overflow
A flaw was found in the loadbuf function in formisc.c. When the buffer is too small, the function tries to resize it, but only by Bsize (=128) bytes. This is not necessarily enough and could cause denial of service.
References:
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=876511
Other sources
Heap-based buffer overflow in the loadbuf function in formisc.c in formail in procmail 3.22 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted e-mail message because of a hardcoded realloc size, a different vulnerability than CVE-2014-3618.
— Debian
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2017-16844?
CVE-2017-16844 has a severity rating that indicates it can lead to denial of service due to improper buffer handling.
How do I fix CVE-2017-16844?
To fix CVE-2017-16844, update the procmail package to a version that is 3.22-26 or higher.
Which versions of procmail are affected by CVE-2017-16844?
Affected versions of procmail include 3.22 up to and including 3.22-25.
What kind of vulnerability is CVE-2017-16844?
CVE-2017-16844 is a denial of service vulnerability caused by improper buffer resizing.
Is CVE-2017-16844 specific to any operating system?
CVE-2017-16844 specifically affects Debian-based systems running the procmail package.