CVE-2004-2771CWE-20

CVE-2004-2771

High · published December 24, 2014

CVSS v2.0

7.5

EPSS

Percentile

94.0

In the wild

Unconfirmed

What it is

The expand function in fio.c in Heirloom mailx 12.5 and earlier and BSD mailx 8.1.2 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in an email address.

The record

Technical detail

CVSS v2.0: 7.5 · HIGH
Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
CVSS v4.0: Not supplied
EPSS: 0.06858 · 94.0th percentile
Weakness: CWE-20 · Improper Input Validation
Published: 2014-12-24T23:59Z

Affected products (6)

Product	Versions	Fixed in
oracle/linux	all versions	—
oracle/linux	all versions	—
redhat/enterprise_linux	all versions	—
redhat/enterprise_linux	all versions	—
bsd_mailx_project/bsd_mailx	≤ 8.1.2	—
heirloom/mailx	≤ 12.5	—

References (16)

EPSS history

Timeline

24 DEC 18:00Z
The expand function in fio.c in Heirloom mailx 12.5 and earlier and BSD mailx 8.1.2 and earlier allows remote attackers to execute arbitrary commands via shell…
cvelistv5