---

CVE-2017-16844 - log back

CVE-2017-16844 created at 25 Sep 2019 19:31:40
Severity	+ Critical
Remote	+ Remote
Type	+ Arbitrary code execution
Description	+ A heap-based buffer overflow flaw was found in the loadbuf function in formisc.c in the formail utility in procmail <= 3.22 because of a hardcoded realloc size. When the buffer is too small, the function tries to resize it, but only by Bsize (=128) bytes which is not necessarily enough. A remote attacker could send a specially crafted email that, when processed by formail, could cause formail to crash or, possibly, execute arbitrary code as the user running formail.
References	+ https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=876511
Notes