CVE-2006-2447
NoneCVSS
—
EPSS
75.8%
Published
Jun 6, 2006
CISA due date
—
The record
SpamAssassin before 3.1.3, when running with vpopmail and the paranoid (-P) switch, allows remote attackers to execute arbitrary commands via a crafted message that is not properly handled when invoking spamd with the virtual pop username.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Debian:10 | spamassassin | 0 | 3.1.3-1 |
| Debian:11 | spamassassin | 0 | 3.1.3-1 |
| Debian:12 | spamassassin | 0 | 3.1.3-1 |
| Debian:13 | spamassassin | 0 | 3.1.3-1 |
| Debian:3.1 | spamassassin | 0 | 3.0.3-2sarge1 |
| Red Hat:enterprise_linux:4::as | spamassassin | 0 | 0:3.0.6-1.el4 |
| Red Hat:enterprise_linux:4::as | spamassassin-debuginfo | 0 | 0:3.0.6-1.el4 |
| Red Hat:enterprise_linux:4::desktop | spamassassin | 0 | 0:3.0.6-1.el4 |
| Red Hat:enterprise_linux:4::desktop | spamassassin-debuginfo | 0 | 0:3.0.6-1.el4 |
| Red Hat:enterprise_linux:4::es | spamassassin | 0 | 0:3.0.6-1.el4 |
| Red Hat:enterprise_linux:4::es | spamassassin-debuginfo | 0 | 0:3.0.6-1.el4 |
| Red Hat:enterprise_linux:4::ws | spamassassin | 0 | 0:3.0.6-1.el4 |
| Red Hat:enterprise_linux:4::ws | spamassassin-debuginfo | 0 | 0:3.0.6-1.el4 |