← Back to branch summary

~ubuntu-security/ubuntu-cve-tracker/master

« back to all changes in this revision

Viewing changes to retired/CVE-2006-4434

  • Committer: Steve Beattie
  • Date: 2019-02-19 06:18:27 UTC
  • Revision ID: sbeattie@ubuntu.com-20190219061827-oh57fzcfc1u9dlfk
The ubuntu-cve-tracker project has been converted to git.

Please use 'git clone https://git.launchpad.net/ubuntu-cve-tracker' to
get the converted tree.

Show diffs side-by-side

added added

removed removed

Lines of Context:
retired/CVE-2006-4434
1
 
PublicDate: 2006-08-28
2
 
Candidate: CVE-2006-4434
3
 
References:
4
 
 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4434
5
 
Description:
6
 
 Use-after-free vulnerability in Sendmail before 8.13.8 allows remote
7
 
 attackers to cause a denial of service (crash) via a long "header line",
8
 
 which causes a previously freed variable to be referenced. NOTE: the
9
 
 original developer has disputed the severity of this issue, saying "The
10
 
 only denial of service that is possible here is to fill up the disk with
11
 
 core dumps if the OS actually generates different core dumps (which is
12
 
 unlikely)... the bug is in the shutdown code (finis()) which leads directly
13
 
 to exit(3), i.e., the process would terminate anyway, no mail delivery or
14
 
 receiption is affected."
15
 
Ubuntu-Description:
16
 
Notes:
17
 
Bugs:
18
 
dapper_sendmail: ignored (reached end-of-life)
19
 
edgy_sendmail: released (8.13.8-1)
20
 
feisty_sendmail: released (8.13.8-1)
21
 
gutsy_sendmail: released (8.13.8-1)
22
 
hardy_sendmail: released (8.13.8-1)
23
 
intrepid_sendmail: released (8.13.8-1)
24
 
jaunty_sendmail: released (8.13.8-1)
25
 
karmic_sendmail: released (8.13.8-1)
26
 
devel_sendmail: released (8.13.8-1)
27
 
upstream_sendmail: released (8.13.8)