OESA-2024-2584

See a problem?
Please try reporting it to the source first.

Source

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2584

Import Source

https://repo.openeuler.org/security/data/osv/OESA-2024-2584.json

JSON Data

https://api.osv.dev/v1/vulns/OESA-2024-2584

Upstream

CVE-2023-42118

Published

2024-12-27T12:32:43Z

Modified

2025-09-03T06:19:26.612465Z

Summary

libspf2 security update

Details

libspf2 is an implementation of the SPF (Sender Policy Framework) specification as found at: http://www.ietf.org/internet-drafts/draft-mengwong-spf-00.txt SPF allows email systems to check SPF DNS records and make sure that an email is authorized by the administrator of the domain name that it is coming from. This prevents email forgery, commonly used by spammers, scammers, and email viruses/worms.

Security Fix(es):

Exim libspf2 Integer Underflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Exim libspf2. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the parsing of SPF macros. When parsing SPF macros, the process does not properly validate user-supplied data, which can result in an integer underflow before writing to memory. An attacker can leverage this vulnerability to execute code in the context of the service account. . Was ZDI-CAN-17578.(CVE-2023-42118)

Database specific

{
    "severity": "High"
}

References

Affected packages

openEuler:22.03-LTS-SP4 / libspf2

Package

Name: libspf2
Purl: pkg:rpm/openEuler/libspf2&distro=openEuler-22.03-LTS-SP4

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.2.11-2.oe2203sp4

Ecosystem specific

{
    "noarch": [
        "libspf2-apidocs-1.2.11-2.oe2203sp4.noarch.rpm"
    ],
    "x86_64": [
        "libspf2-1.2.11-2.oe2203sp4.x86_64.rpm",
        "libspf2-debuginfo-1.2.11-2.oe2203sp4.x86_64.rpm",
        "libspf2-debugsource-1.2.11-2.oe2203sp4.x86_64.rpm",
        "libspf2-devel-1.2.11-2.oe2203sp4.x86_64.rpm",
        "libspf2-progs-1.2.11-2.oe2203sp4.x86_64.rpm",
        "perl-Mail-SPF_XS-1.2.11-2.oe2203sp4.x86_64.rpm"
    ],
    "aarch64": [
        "libspf2-1.2.11-2.oe2203sp4.aarch64.rpm",
        "libspf2-debuginfo-1.2.11-2.oe2203sp4.aarch64.rpm",
        "libspf2-debugsource-1.2.11-2.oe2203sp4.aarch64.rpm",
        "libspf2-devel-1.2.11-2.oe2203sp4.aarch64.rpm",
        "libspf2-progs-1.2.11-2.oe2203sp4.aarch64.rpm",
        "perl-Mail-SPF_XS-1.2.11-2.oe2203sp4.aarch64.rpm"
    ],
    "src": [
        "libspf2-1.2.11-2.oe2203sp4.src.rpm"
    ]
}

Database specific

source

"https://repo.openeuler.org/security/data/osv/OESA-2024-2584.json"