sendmail vulnerabilities and fixes

Recent CVEs affecting sendmail, with upgrade or downgrade steps. 37 tracked.

sendmail has 37 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 13. Most recent: 2023-12-24. Highest priority: CVE-2002-1337 (score 70/100).

• CVE-2023-51765 MEDIUM 5.3 UPGRADE UPGRADE sendmail through 8.17.2 allows SMTP smuggling in certain configurations
• CVE-2021-3618 HIGH 7.4 UPGRADE UPGRADE ALPACA is an application layer protocol content confusion attack, exploiting TLS servers implementing differen
• CVE-2014-3956 LOW 1.9 UPGRADE UPGRADE The sm_close_on_exec function in conf.c in sendmail before 8.14.9 has arguments in the wrong order, and conseq
• CVE-2009-4565 HIGH 7.5 UPGRADE sendmail before 8.14.4 does not properly handle a '\0' character in a Common Name (CN) field of an X.509 certi
• CVE-2009-1490 MEDIUM 5.0 UPGRADE Heap-based buffer overflow in Sendmail before 8.13.2 allows remote attackers to cause a denial of service (dae
• CVE-2007-2246 HIGH 7.8 DOWNGRADE Unspecified vulnerability in HP-UX B.11.00 and B.11.11, when running sendmail 8.9.3 or 8.11.1; and HP-UX B.11.
• CVE-2006-7176 MEDIUM 4.3 DOWNGRADE The version of Sendmail 8.13.1-2 on Red Hat Enterprise Linux 4 Update 4 and earlier does not reject the "local
• CVE-2006-7175 HIGH 7.5 DOWNGRADE The version of Sendmail 8.13.1-2 on Red Hat Enterprise Linux 4 Update 4 and earlier does not allow the adminis
• CVE-2006-4434 HIGH 7.5 UPGRADE Use-after-free vulnerability in Sendmail before 8.13.8 allows remote attackers to cause a denial of service (c
• CVE-2006-1173 MEDIUM 5.0 UPGRADE Sendmail before 8.13.7 allows remote attackers to cause a denial of service via deeply nested, malformed multi
• CVE-2006-0058 HIGH 7.6 DOWNGRADE Signal handler race condition in Sendmail 8.13.x before 8.13.6 allows remote attackers to execute arbitrary co
• CVE-2005-2070 MEDIUM 5.0 DOWNGRADE The ClamAV Mail fILTER (clamav-milter) 0.84 through 0.85d, when used in Sendmail using long timeouts, allows r
• CVE-2003-0694 HIGH 10.0 DOWNGRADE DOWNGRADE The prescan function in Sendmail 8.12.9 allows remote attackers to execute arbitrary code via buffer overflow
• CVE-2003-0688 MEDIUM 5.0 DOWNGRADE DOWNGRADE The DNS map code in Sendmail 8.12.8 and earlier, when using the "enhdnsbl" feature, does not properly initiali
• CVE-2003-0681 HIGH 7.5 DOWNGRADE DOWNGRADE A "potential buffer overflow in ruleset parsing" for Sendmail 8.12.9, when using the nonstandard rulesets (1)
• CVE-2003-0308 HIGH 7.2 DOWNGRADE MITIGATE The Sendmail 8.12.3 package in Debian GNU/Linux 3.0 does not securely create temporary files, which could allo
• CVE-2003-0161 HIGH 10.0 DOWNGRADE DOWNGRADE The prescan() function in the address parser (parseaddr.c) in Sendmail before 8.12.9 does not properly handle
• CVE-2002-2423 MEDIUM 6.4 DOWNGRADE Sendmail 8.12.0 through 8.12.6 truncates log messages longer than 100 characters, which allows remote attacker
• CVE-2002-2261 HIGH 7.5 DOWNGRADE Sendmail 8.9.0 through 8.12.6 allows remote attackers to bypass relaying restrictions enforced by the 'check_r
• CVE-2002-1827 LOW 2.1 DOWNGRADE Sendmail 8.9.0 through 8.12.3 allows local users to cause a denial of service by obtaining an exclusive lock o
• CVE-2002-1337 HIGH 10.0 UPGRADE MITIGATE Buffer overflow in Sendmail 5.79 to 8.12.7 allows remote attackers to execute arbitrary code via certain forma
• CVE-2002-1165 MEDIUM 4.6 DOWNGRADE MITIGATE Sendmail Consortium's Restricted Shell (SMRSH) in Sendmail 8.12.6, 8.11.6-15, and possibly other versions afte
• CVE-2002-0906 HIGH 7.5 DOWNGRADE Buffer overflow in Sendmail before 8.12.5, when configured to use a custom DNS map to query TXT records, allow
• CVE-2001-1349 LOW 3.7 DOWNGRADE Sendmail before 8.11.4, and 8.12.0 before 8.12.0.Beta10, allows local users to cause a denial of service and p
• CVE-2001-0715 LOW 2.1 UPGRADE Sendmail before 8.12.1, without the RestrictQueueRun option enabled, allows local users to obtain potentially
• CVE-2001-0714 LOW 2.1 UPGRADE Sendmail before 8.12.1, without the RestrictQueueRun option enabled, allows local users to cause a denial of s
• CVE-2001-0713 MEDIUM 4.6 UPGRADE Sendmail before 8.12.1 does not properly drop privileges when the -C option is used to load custom configurati
• CVE-2001-0653 MEDIUM 4.6 DOWNGRADE Sendmail 8.10.0 through 8.11.5, and 8.12.0 beta, allows local users to modify process memory and possibly gain
• CVE-2000-0319 MEDIUM 5.0 DOWNGRADE mail.local in Sendmail 8.10.x does not properly identify the .\n string which identifies the end of message te
• CVE-1999-1592 HIGH 7.5 DOWNGRADE Multiple unspecified vulnerabilities in sendmail 5, as installed on Sun SunOS 4.1.3_U1 and 4.1.4, have unspeci
• CVE-1999-1109 MEDIUM 5.0 UPGRADE Sendmail before 8.10.0 allows remote attackers to cause a denial of service by sending a series of ETRN comman
• CVE-1999-0976 LOW 2.1 DOWNGRADE Sendmail allows local users to reinitialize the aliases database via the newaliases command, then cause a deni
• CVE-1999-0684 MEDIUM 5.0 DOWNGRADE Denial of service in Sendmail 8.8.6 in HPUX.
• CVE-1999-0478 MEDIUM 5.0 UPGRADE Denial of service in HP-UX sendmail 8.8.6 related to accepting connections.
• CVE-1999-0393 MEDIUM 5.0 DOWNGRADE Remote attackers can cause a denial of service in Sendmail 8.8.x and 8.9.2 by sending messages with a large nu
• CVE-1999-0365 HIGH 7.5 DOWNGRADE DOWNGRADE The metamail package allows remote command execution using shell metacharacters that are not quoted in a mailc
• CVE-1999-0205 MEDIUM 5.0 DOWNGRADE Denial of service in Sendmail 8.6.11 and 8.6.12.

FAQ

How do I fix sendmail vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is sendmail being exploited right now?

None of the tracked sendmail CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which sendmail CVE should I patch first?

CVE-2002-1337 currently ranks highest (70/100): Buffer overflow in Sendmail 5.79 to 8.12.7 allows remote attackers to execute arbitrary code via certain forma.

RSS feed for sendmail · ← Back to latest CVEs