Buffer overflow in Debian Xbuffy

CVE-2014-0469

Stack-based buffer overflow in a certain Debian patch for xbuffy before 3.3.bl.3.dfsg-9 allows remote attackers to execute arbitrary code via the subject of an email, possibly related to indent subject lines.

Vulnerability class: Buffer Overflow

EPSS: 0.034 (87.7th percentile) — read the EPSS interpretation.

Affected products

Debian Xbuffy — versions 3.2.1-1, 3.2.1-2, 3.2.1-3
N/a — versions n/a

Weakness classification (CWE)

CWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer

References

security@debian.org (vdb-entry, x_refsource_BID)
security@debian.org (vendor-advisory, x_refsource_DEBIAN)
security@debian.org (mailing-list, x_refsource_MLIST)
security@debian.org (x_refsource_CONFIRM)