DEBIAN-CVE-2010-1132

The mlfi_envrcpt function in spamass-milter.cpp in SpamAssassin Milter Plugin 0.3.1, when using the expand option, allows remote attackers to execute arbitrary system commands via shell metacharacters in the RCPT TO field of an email message.

References

https://security-tracker.debian.org/tracker/CVE-2010-1132

Affected packages

Debian:11 / spamass-milter

Package

Name: spamass-milter
Purl: pkg:deb/debian/spamass-milter?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

0.3.1-9

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Database specific

source

"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2010-1132.json"

Debian:12 / spamass-milter

Package

Name: spamass-milter
Purl: pkg:deb/debian/spamass-milter?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

0.3.1-9

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Database specific

source

"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2010-1132.json"

Debian:13 / spamass-milter

Package

Name: spamass-milter
Purl: pkg:deb/debian/spamass-milter?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

0.3.1-9

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Database specific

source

"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2010-1132.json"

Debian:14 / spamass-milter

Package

Name: spamass-milter
Purl: pkg:deb/debian/spamass-milter?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

0.3.1-9

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Database specific

source

"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2010-1132.json"