CVE-2015-7687

EUVD-2015-7589
Use-after-free vulnerability in OpenSMTPD before 5.7.2 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via vectors involving req_ca_vrfy_smtp and req_ca_vrfy_mta.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
9.8 CRITICAL
NETWORK
LOW
NONE
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 92%
Affected Products (NVD)
VendorProductVersion
openbsdopensmtpd
𝑥
≤ 5.7.1
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
opensmtpd
bookworm
6.8.0p2-4
fixed
bullseye
6.8.0p2-3
fixed
sid
7.5.0p0-1
fixed
trixie
7.5.0p0-1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
opensmtpd
artful
ignored
bionic
not-affected
cosmic
not-affected
disco
not-affected
focal
not-affected
jammy
not-affected
kinetic
not-affected
lunar
not-affected
mantic
not-affected
noble
not-affected
precise
dne
trusty
needed
vivid
ignored
wily
ignored
xenial
not-affected
yakkety
ignored
zesty
ignored
Common Weakness Enumeration
References
http://lists.fedoraproject.org/pipermail/package-announce/2015-November/170448.html
http://lists.fedoraproject.org/pipermail/package-announce/2015-October/169600.html
http://www.openwall.com/lists/oss-security/2015/10/03/1
http://www.securityfocus.com/bid/76975
https://bugzilla.redhat.com/show_bug.cgi?id=1268793
https://www.opensmtpd.org/announces/release-5.7.2.txt
https://www.qualys.com/2015/10/02/opensmtpd-audit-report.txt
http://lists.fedoraproject.org/pipermail/package-announce/2015-November/170448.html
http://lists.fedoraproject.org/pipermail/package-announce/2015-October/169600.html
http://www.openwall.com/lists/oss-security/2015/10/03/1
http://www.securityfocus.com/bid/76975
https://bugzilla.redhat.com/show_bug.cgi?id=1268793
https://www.opensmtpd.org/announces/release-5.7.2.txt
https://www.qualys.com/2015/10/02/opensmtpd-audit-report.txt