PT-2014-1800 · Debian · Xbuffy

Published 2014-05-05 · Updated 2014-05-31 · CVE-2014-0469

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions xbuffy versions prior to 3.3.bl.3.dfsg-9

Description The issue is related to a stack-based buffer overflow in a certain Debian patch for xbuffy, which allows remote attackers to execute arbitrary code via the subject of an email. This could be related to indent subject lines. Additionally, there are multiple vulnerabilities in the xbuffy package of the Debian GNU/Linux operating system that can lead to breaches of confidentiality, integrity, and availability of protected information, and these vulnerabilities can be exploited remotely.

Recommendations For xbuffy versions prior to 3.3.bl.3.dfsg-9, update to version 3.3.bl.3.dfsg-9 or later to resolve the issue. As a temporary workaround, consider restricting access to email subjects to minimize the risk of exploitation. Avoid using the subject variable in email processing until the issue is resolved.

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

BDU:2015-04131

CVE-2014-0469

DSA-2921-1

Affected Products

Xbuffy

References · 14

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0469 · Security Note
• https://cve.org/CVERecord?id=CVE-2014-0469 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2014-0469 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2014-0469 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-0469 · Security Note
• http://debian.org/security/2014/dsa-2921 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2014-0469 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2014-0469 · Vendor Advisory
• https://ubuntu.com/security/CVE-2014-0469 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-04131 · Security Note
• http://debian.org/security/dsa-2921 · Note
• http://packages.qa.debian.org/x/xbuffy/news/20140427T181904Z.html · Note
• http://securityfocus.com/bid/67090 · Note
• http://openwall.com/lists/oss-security/2014/04/28/3 · Note