PT-2010-4058 · Bogofilter+1 · Bogofilter+2

Published 2010-07-08 · Updated 2013-02-14 · CVE-2010-2494

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions bogofilter versions prior to 1.2.2 bogolexer versions prior to 1.2.2

Description The issue is related to multiple buffer underflows in the base64 decoder. This can be exploited by remote attackers via an e-mail message containing invalid base64 data that starts with an = (equals) character, leading to a denial of service due to heap memory corruption and application crash.

Recommendations For bogofilter versions prior to 1.2.2, update to version 1.2.2 or later to resolve the issue. For bogolexer versions prior to 1.2.2, update to version 1.2.2 or later to resolve the issue.

Fix

DoS

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2010-2494

OPENSUSE-SU-2012_1648-1

OPENSUSE-SU-2012_1650-1

OPENSUSE-SU-2013_0166-1

OPENSUSE-SU-2024:10502-1

Affected Products

Suse

Bogofilter

Bogolexer

References · 30

• http://lists.opensuse.org/opensuse-security-announce/2012-12/msg00015.html · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2010-August/046590.html · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2010-2494 · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2010-August/046558.html · Vendor Advisory
• http://ubuntu.com/usn/USN-980-1 · Vendor Advisory
• http://bogofilter.svn.sourceforge.net/viewvc/bogofilter/trunk/bogofilter/src/base64.c?view=patch&r1=6906&r2=6903 · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2010-2494 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2010-2494 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2012-12/msg00016.html · Vendor Advisory
• http://marc.info/?l=oss-security&m=127840569013531&w=2 · Patch
• http://lists.opensuse.org/opensuse-security-announce/2010-08/msg00001.html · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00021.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2010-2494 · Security Note
• http://secunia.com/advisories/40427 · Vendor Advisory
• http://osvdb.org/66002 · Note